Splunk Auding for changes in macro

anilyelmar — Fri, 18 Jan 2019 09:21:04 GMT

Can someone please help me here :I have a search giving me the details of users who modified macros
index=_internal method=POST sourcetype=splunkd_ui_access uri_path=/en-US/manager/search/admin/macros/my_*indexes | rex field=uri_path "\/en-US\/manager\/search\/admin\/macros\/(?<macro>.*)" |table _time host user macro
How can I add more details to it like what the current and previous definition for each of macro.

only what I can get the current definition is by

| rest /servicesNS/-/-/admin/macros splunk_server=local |search title=<macro>

So my current version of search is below and I am looking the way how I can add the previousDefinition of macro before it was edited .

index=_internal method=POST sourcetype=splunkd_ui_access uri_path=/en-US/manager/search/admin/macros/my_*indexes | rex field=uri_path "\/en-US\/manager\/search\/admin\/macros\/(?<title>.*)" | join type=left title [ | rest /servicesNS/-/-/admin/macros splunk_server=local]|rename definition as currentDef |table _time host user title currentDef

Re: Splunk Auding for changes in macro

harsmarvania57 — Fri, 18 Jan 2019 13:46:00 GMT

Hi,

In splunk thre are no such auditing functionality which will provide you previous macro configuration and current macro configuration Or difference between them. Please submit ER (Enhacement Request) with Splunk.

For future config changes you may try this app https://splunkbase.splunk.com/app/3295/

topic Splunk Auding for changes in macro in Knowledge Management

Splunk Auding for changes in macro

Re: Splunk Auding for changes in macro