diff --git a/cyences_app_for_splunk/default/savedsearches.conf b/cyences_app_for_splunk/default/savedsearches.conf
index 63d5bf46..d0ce60b3 100644
--- a/cyences_app_for_splunk/default/savedsearches.conf
+++ b/cyences_app_for_splunk/default/savedsearches.conf
@@ -4164,7 +4164,7 @@ request.ui_dispatch_app = cyences_app_for_splunk
 request.ui_dispatch_view = search
 search = | inputlookup cs_linux_users \
 | addinfo | where _time>=info_min_time and _time <info_max_time \
-| table host UID _time USERNAME COMMAND_SHELL HOME_DIR SUDOACCESS USER_INFO GID status \
+| table host UID _time USERNAME COMMAND_SHELL HOME_DIR SUDOACCESS USER_INFO GID status changes \
 | eval cyences_severity = case(UID=0, "high",1=1, "medium") \
 | `cs_change_in_user_linux_filter`
 action.cyences_notable_event_action = 1
@@ -4198,7 +4198,7 @@ request.ui_dispatch_app = cyences_app_for_splunk
 request.ui_dispatch_view = search
 search = | inputlookup cs_linux_groups \
 | addinfo | where _time>=info_min_time and _time <info_max_time \
-| table _time host group_name users status \
+| table _time host group_name users status changes \
 | eval cyences_severity = case(group_name="root", "high",1=1, "medium") \
 | `cs_change_in_group_of_linux_filter`
 action.cyences_notable_event_action = 1