Splunk search for completed certification campaign

Identity Security Cloud (ISC) ISC Discussion and Questions
1

We have configured IDN to send logs to our Splunk environment and I have been able to get very useful information out of that configuration and created some dashboards inside splunk to monitor different things.

I have some issue to find if a certification campaign has been completed. I’m able to find when a certification campaign is created and when its activated but not when its completed.

Does anyone have any suggestion on how to see if a certification campaign has been completed from any action or technicalName fields inside splunk?

I have looked on this thread but im not able to find any certification campaign completed.
Since it mentioned the technicalName CERTIFICATION_CAMPAIGN_COMPLETE_PASSED
Anyone else able to find these in your environment?

Search events for Splunk - Identity Security Cloud (ISC) / ISC Discussion and Questions - SailPoint Developer Community Forum

2

are you able to see the completion event, “Complete Certification Campaign Passed” or “Signoff Certification Passed” in ISC2?

3

Even if we have created campaign for us to try to complete, reassign, sign off and delete I’m only getting these different technicalName
image

When i use this splunk search:

index=* technicalName=*Certification*

So I get some of the certification related logs but not the one I’m looking for.
I would like to be able to see how many has been created and how many has been completed to be able to see how many are still active without looking inside IDN.