https://community.splunk.com/t5/Getting-Data-In/Auditing-changes-to-Splunk-configurations-files-related-to-users/m-p/98680#M97529 <P>I am trying to find out how much auditing is built-in in Splunk related to adding/deleting/updating</P> <UL> <LI>Users </LI> <LI>Configuration (inputs.conf,outputs.conf)</LI> <LI>Parsing/processing (props.conf, transforms.con)</LI> </UL> <P>I added a new file or a new user, and tried to find out an audit event, but I could not find it in the internal indexes?</P> <P>May be I need to monitor all the Splunk config files?</P> <P>Thanks, Jean</P> Fri, 03 Dec 2010 05:53:42 GMT jdagenais 2010-12-03T05:53:42Z https://community.splunk.com/t5/Getting-Data-In/Auditing-changes-to-Splunk-configurations-files-related-to-users/m-p/98680#M97529 <P>I am trying to find out how much auditing is built-in in Splunk related to adding/deleting/updating</P> <UL> <LI>Users </LI> <LI>Configuration (inputs.conf,outputs.conf)</LI> <LI>Parsing/processing (props.conf, transforms.con)</LI> </UL> <P>I added a new file or a new user, and tried to find out an audit event, but I could not find it in the internal indexes?</P> <P>May be I need to monitor all the Splunk config files?</P> <P>Thanks, Jean</P> Fri, 03 Dec 2010 05:53:42 GMT https://community.splunk.com/t5/Getting-Data-In/Auditing-changes-to-Splunk-configurations-files-related-to-users/m-p/98680#M97529 jdagenais 2010-12-03T05:53:42Z https://community.splunk.com/t5/Getting-Data-In/Auditing-changes-to-Splunk-configurations-files-related-to-users/m-p/98681#M97530 <P>In current implementation, any changes made to the environment will not likely be logged within Splunk, certainly not in _internal et al. If you make changes via config files outside the UI or API, those things actions and changes can't be logged within Splunk.</P> <P>You can ingest the files themselves to compare _raw or even single line values, depending on your parsing preferences. However, it might be useful to have an external tool create hashes of all the files and store a log entry into Splunk with the hash, full path, and other metadata about the files. Then you can more easily report on changes to any of these files, including users.</P> Tue, 16 Jun 2015 17:37:15 GMT https://community.splunk.com/t5/Getting-Data-In/Auditing-changes-to-Splunk-configurations-files-related-to-users/m-p/98681#M97530 jtrucks 2015-06-16T17:37:15Z