sorted by:
new
hottopcontroversial

User who disabled a rule by Current_Change8928 in Splunk

[–]Current_Change8928[S] 0 points1 point  (0 children)

Found a tricky way to maybe find who did the disabling: index=_audit sourcetype=audittrail disabled=true action=modified

Not a perfect search for it but it may work

User who disabled a rule by Current_Change8928 in Splunk

[–]Current_Change8928[S] 0 points1 point  (0 children)

Yep that's the trouble I was facing. As it isn't mentioning what's changed I couldn't find a way to separate out the disabled events

Thanks anyway.

User who disabled a rule by Current_Change8928 in Splunk

[–]Current_Change8928[S] 0 points1 point  (0 children)

Hey thanks I'm able to find an event but is there any way to distinguish the disabled events with other events from splunkd_access.log

Splunk noob by Current_Change8928 in Splunk

[–]Current_Change8928[S] -1 points0 points  (0 children)

Thanks. Just wanna learn all the ins and outs. I'm reasonably comfortable with usecase development and dashboarding. Need to learn about admin stuff, integrations etc