Hello Thwack community members,
My events history indicated in our Solarwinds platform that about six nodes were removed and added back after 15 minutes. However, I could not find the account associated to remove and add these nodes.
I tried to use a report query suggested on the below link but did not get the username and the nodes reported on the event. I also checked no admin account were logged during that time.
is there any other way I could trace the user account used for these changes or the validity of these event messages?