https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Splunk-changes/m-p/502698#M8440 <P>Yeah, this is available in the audit index too. Please accept the answer if this answered your questions</P> <P>index=_audit action=indexes_edit</P> Wed, 30 Sep 2020 03:20:37 GMT skoelpin 2020-09-30T03:20:37Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Splunk-changes/m-p/502695#M8437 <P>Hello, </P> <P>Looking for a way to monitor certain operational changes in Splunk like:<BR /> - A new sourcetype has been created.<BR /> - A new Input has been created.<BR /> - An input was removed/deleted.<BR /> - An Alert or Report was created or deleted.</P> Mon, 09 Dec 2019 16:06:41 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Splunk-changes/m-p/502695#M8437 guarisma 2019-12-09T16:06:41Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Splunk-changes/m-p/502696#M8438 <P>You should use version control for any conf changes made to your indexers, search heads, deployment servers, etc.. You can also leverage the internal log to answer the alert/report modification </P> <P>index=_audit </P> Mon, 09 Dec 2019 16:22:40 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Splunk-changes/m-p/502696#M8438 skoelpin 2019-12-09T16:22:40Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Splunk-changes/m-p/502697#M8439 <P>What event will tell me a new index was created in Splunk Cloud?</P> Mon, 09 Dec 2019 17:59:48 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Splunk-changes/m-p/502697#M8439 guarisma 2019-12-09T17:59:48Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Splunk-changes/m-p/502698#M8440 <P>Yeah, this is available in the audit index too. Please accept the answer if this answered your questions</P> <P>index=_audit action=indexes_edit</P> Wed, 30 Sep 2020 03:20:37 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-monitor-Splunk-changes/m-p/502698#M8440 skoelpin 2020-09-30T03:20:37Z