https://community.splunk.com/t5/Getting-Data-In/Change-log-on-searches-dashboards-macros-etc/m-p/68631#M13896 <P>Changes to the app configuration files are monitored but i'm not sure if you'll get all of that detail in the audit event. </P> <P>Audit events are generated from monitoring:</P> <PRE><CODE>all files in Splunk's configuration directory $SPLUNK_HOME/etc/* files are monitored for add/change/delete using the file system change monitor. </CODE></PRE> Tue, 12 Jun 2012 12:34:02 GMT sdaniels 2012-06-12T12:34:02Z https://community.splunk.com/t5/Getting-Data-In/Change-log-on-searches-dashboards-macros-etc/m-p/68628#M13893 <P>My customer want me to provide a change log on saved searches/dashboards/macros etc.</P> <P>I.e.: Change date, changed by user, old search content, new search content.</P> <P>The same apply to dashboards, macros etc.</P> <P>Where can I find this log?</P> Wed, 06 Jun 2012 14:02:08 GMT https://community.splunk.com/t5/Getting-Data-In/Change-log-on-searches-dashboards-macros-etc/m-p/68628#M13893 JYTTEJ 2012-06-06T14:02:08Z https://community.splunk.com/t5/Getting-Data-In/Change-log-on-searches-dashboards-macros-etc/m-p/68629#M13894 <P>This will give you the details on what activity is logged for users in Splunk.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/AuditSplunkactivity">http://docs.splunk.com/Documentation/Splunk/latest/admin/AuditSplunkactivity</A></P> Wed, 06 Jun 2012 15:24:08 GMT https://community.splunk.com/t5/Getting-Data-In/Change-log-on-searches-dashboards-macros-etc/m-p/68629#M13894 sdaniels 2012-06-06T15:24:08Z https://community.splunk.com/t5/Getting-Data-In/Change-log-on-searches-dashboards-macros-etc/m-p/68630#M13895 <P>I have read through the above documentation - but I did not find anything about audit trail on change on saved searches/dashboards/macros etc.</P> <P>Does this mean that no such audittrail exist?</P> Tue, 12 Jun 2012 12:12:06 GMT https://community.splunk.com/t5/Getting-Data-In/Change-log-on-searches-dashboards-macros-etc/m-p/68630#M13895 JYTTEJ 2012-06-12T12:12:06Z https://community.splunk.com/t5/Getting-Data-In/Change-log-on-searches-dashboards-macros-etc/m-p/68631#M13896 <P>Changes to the app configuration files are monitored but i'm not sure if you'll get all of that detail in the audit event. </P> <P>Audit events are generated from monitoring:</P> <PRE><CODE>all files in Splunk's configuration directory $SPLUNK_HOME/etc/* files are monitored for add/change/delete using the file system change monitor. </CODE></PRE> Tue, 12 Jun 2012 12:34:02 GMT https://community.splunk.com/t5/Getting-Data-In/Change-log-on-searches-dashboards-macros-etc/m-p/68631#M13896 sdaniels 2012-06-12T12:34:02Z