Members

The following Splunk query will show a table of all users and their roles:
| rest /services/authentication/users | stats values(roles) as Roles by user
*Admin Notes*
I’ve found the following query to work […]

This Splunk query shows when the admin account performed Create or Modify Roles actions:
index=”_audit” action=edit_roles operation=* | table _time user operation object*

This Splunk query shows when the admin account performed Account Modification / Deletion / Creation actions:
index=_audit user=admin action=edit_user operation=* | table _time user operation object*

This Splunk query should show which users attempted to modify an index and if that action was successful:
index=_audit user=* action=indexes_edit | stats count by index info user action

Use the following simple tstats query to return the latest time events came in for a given index as well as list all sourcetypes for each index:
|tstats values(sourcetype) as Sourcetype latest(_time) as Time […]

This Splunk Query shows if there is a time offset on your Splunk servers. I borrowed and modified this one from the splunk clock skew search posted on http://www.bbosearch.com (another pretty awesome site like this […]

This will show events that have been sent to the null que within the splunk internal logs.

 
index=_internal component=metrics processor=nullqueue group=pipeline sourcetype=splunkd | table _time log_level […]

The following splunk search looks for changes in services within Windows.

 
sourcetype=”WinEventLog:System” EventCode=7045 NOT (Service_Name=mgmt_service) | eval Message=split(Message,”.”) | eval […]

This splunk search will show file shares being accessed within windows environments.
sourcetype=”WinEventLog:Security” EventCode=5140 (Share_Name=”*C$” OR Share_Name=”*D$” OR Share_Name=”*E$” OR […]