topic configuration_change.log is not enabled by default- Splunk not logging anything into that log? in Getting Data In

configuration_change.log is not enabled by default- Splunk not logging anything into that log?

glpadilla_sol — Tue, 28 Jun 2022 16:41:38 GMT

Hello everyone,

I have been reading about the way Splunk can audit the changes at the configuration files and I found this as a possibility

But even though the documentation said is enabled by default my Splunk instance is not logging anything into that log

Do you know what I should be doing to track it?

Current Version 8.2.2

Cluster environment

Linux

Thank you in advance.

jamie00171 — Mon, 27 Jun 2022 21:19:05 GMT

The default actually seems to be :

[config_change_audit]
disabled = true
mode = auto

so you'll need to set that to false to enable it.

Thanks,

Jamie

glpadilla_sol — Mon, 27 Jun 2022 21:53:34 GMT

Thank you so much!