https://community.splunk.com/t5/Getting-Data-In/How-do-you-audit-for-who-is-disabling-Data-Input/m-p/435454#M100256 <P>Recently, we found one data input for receiving syslog was stopped.</P> <P>We don't know if the service issue is auto stop or someone disabling it. i tried to search index=_audit, </P> <P>Also, I even saw some log edit server, only see the action is edit server but it didn't mention what setting had been changed.</P> Thu, 30 Aug 2018 02:47:25 GMT kennethyeung 2018-08-30T02:47:25Z https://community.splunk.com/t5/Getting-Data-In/How-do-you-audit-for-who-is-disabling-Data-Input/m-p/435454#M100256 <P>Recently, we found one data input for receiving syslog was stopped.</P> <P>We don't know if the service issue is auto stop or someone disabling it. i tried to search index=_audit, </P> <P>Also, I even saw some log edit server, only see the action is edit server but it didn't mention what setting had been changed.</P> Thu, 30 Aug 2018 02:47:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-audit-for-who-is-disabling-Data-Input/m-p/435454#M100256 kennethyeung 2018-08-30T02:47:25Z