topic Query to check tags activity in Knowledge Management

Query to check tags activity

Poojitha — Thu, 27 Jun 2024 11:05:03 GMT

Hi All,

I have created few tags in splunk which are getting disabled automatically. I want to check using splunk query the time they are getting disabled.

Please can anyone of you suggest me the query for this . I tried using REST but not getting exact details.

I also tried below but not seeing any related logs.

index=_internal sourcetype=splunk_audit action=edit status=disabled info=tags

Thanks in advance,
PNV

Re: Query to check tags activity

ITWhisperer — Thu, 27 Jun 2024 11:56:42 GMT

Have you tried looking in the _audit index?

index="_audit" action=disable_tag

Re: Query to check tags activity

Poojitha — Thu, 27 Jun 2024 15:23:18 GMT

@ITWhisperer : I tried this. But I am not seeing any log for action=disable_tag. I am just seeing for action=enable_tag.