topic Any App to audit changes in Splunk Enterprise distributed environment ? in All Apps and Add-ons

Any App to audit changes in Splunk Enterprise distributed environment ?

neerajs_81 — Thu, 07 Apr 2022 09:20:49 GMT

Hi, is there any app similar to https://splunkbase.splunk.com/app/4144/ for auditing changes made to different settings, conf files in a Clustered deployment ? If there is NO app, can someone recommend a report that can be run ?

Any help appreciated.

Re: Any App to audit changes in Splunk Enterprise distributed environment ?

VatsalJagani — Thu, 07 Apr 2022 16:48:29 GMT

@neerajs_81 - Try this App for configuration changes monitoring. (I've not tried it personally but it sounds promising.)

Git Version Control App for Splunk - https://splunkbase.splunk.com/app/4182/

You can search through splunkd_access logs, it will give you what component changed, and who changed it but will not tell the old value and new value.

index="_internal" sourcetype="splunkd_access"

I hope this helps!!

Re: Any App to audit changes in Splunk Enterprise distributed environment ?

neerajs_81 — Fri, 08 Apr 2022 04:29:43 GMT

Thank you, checking it out.

Re: Any App to audit changes in Splunk Enterprise distributed environment ?

gjanders — Tue, 19 Apr 2022 10:36:50 GMT

Also refer to previous answers https://community.splunk.com/t5/Dashboards-Visualizations/Version-control-management-for-Splunk-Dashboards-Reports-and/td-p/437788

Version control for splunk also does this among other options...the knowledge object overview app on SplunkBase has some queries for this too. https://splunkbase.splunk.com/app/5399/

Re: Any App to audit changes in Splunk Enterprise distributed environment ?

neerajs_81 — Wed, 20 Apr 2022 12:00:13 GMT

Thank you