topic How can I audit changes made to Splunk Role Index access? in Security

How can I audit changes made to Splunk Role Index access?

nthornbury — Wed, 05 Jul 2017 21:07:57 GMT

Can someone point me in the right direction to find info concerning auditing Splunk Cloud role changes? Specifically, I need to find out who/when an index access change occurred for a role in our Splunk Cloud deployment. I have tried searching the audit index, yet I don't get any info that says: `this user account________ on this date__________ modified the index access list for this role________`?

Thank you.

Re: How can I audit changes made to Splunk Role Index access?

randy_moore — Fri, 15 Jun 2018 15:33:06 GMT

@nthornbury - Were you ever able to get this solved?

Re: How can I audit changes made to Splunk Role Index access?

nthornbury — Mon, 18 Jun 2018 13:57:09 GMT

Yes, I am good to go on this one. Thank you for the follow-up!

Re: How can I audit changes made to Splunk Role Index access?

nthornbury — Mon, 18 Jun 2018 13:57:41 GMT

Problem Solved.

Re: How can I audit changes made to Splunk Role Index access?

peter_krammer — Mon, 13 Aug 2018 08:56:46 GMT

Would you be so kind and share how you solved it, so that others can benefit from the info.

Re: How can I audit changes made to Splunk Role Index access?

nthornbury — Tue, 29 Sep 2020 20:51:10 GMT

Peter,

I developed a report that runs each week, and sends me the reults fo the following search string:

index=_audit source=audittrail operation=edit action!=search action=edit_roles

You could modify this search with other parameters that suit your particular needs or frequency. The above, will show you all mods made to the admin role. I hope that helps. Thanks!