Splunk 5.0.5, Does Splunk logs object deletion activity from Splunk Web ?

somesoni2 — Wed, 08 Jan 2014 22:14:11 GMT

Hi,

We have a shared development environment for Splunk (version 5.0.5) where many users do create/updated/delete Splunk objects (e.g. saved searches/views/lookups etc).

Does Splunk logs any information in any internal logs for who created (not imp at this point)/deleted (this is what I want to know for sure)/updated any of the objects? Something like auditing Splunk Web activities.

Appreciate your help.

Re: Splunk 5.0.5, Does Splunk logs object deletion activity from Splunk Web ?

rahulroy_splunk — Wed, 08 Jan 2014 22:41:11 GMT

This seems to be working for deleted items.

index=_internal sourcetype=splunkd_access method="DELETE"

I'm too looking for "UPDATE" but no luck so far.

topic Re: Splunk 5.0.5, Does Splunk logs object deletion activity from Splunk Web ? in Getting Data In

Splunk 5.0.5, Does Splunk logs object deletion activity from Splunk Web ?

Re: Splunk 5.0.5, Does Splunk logs object deletion activity from Splunk Web ?