https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-there-an-Audit-log-that-tracks-changes-to-content-in-Splunk/m-p/358572#M3498 <P>We have multiple people making changes to the content in Splunk Enterprise Security and I need to be able to track down when someone changed content.</P> Tue, 02 May 2017 12:21:16 GMT john_glasscock 2017-05-02T12:21:16Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-there-an-Audit-log-that-tracks-changes-to-content-in-Splunk/m-p/358572#M3498 <P>We have multiple people making changes to the content in Splunk Enterprise Security and I need to be able to track down when someone changed content.</P> Tue, 02 May 2017 12:21:16 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-there-an-Audit-log-that-tracks-changes-to-content-in-Splunk/m-p/358572#M3498 john_glasscock 2017-05-02T12:21:16Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-there-an-Audit-log-that-tracks-changes-to-content-in-Splunk/m-p/358573#M3499 <P>yes sir,<BR /> what exactly are you after?</P> Tue, 02 May 2017 12:36:21 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-there-an-Audit-log-that-tracks-changes-to-content-in-Splunk/m-p/358573#M3499 adonio 2017-05-02T12:36:21Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-there-an-Audit-log-that-tracks-changes-to-content-in-Splunk/m-p/358574#M3500 <P>I am trying to see who and when someone change a correlation search in Enterprise Security.</P> Tue, 02 May 2017 12:59:45 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-there-an-Audit-log-that-tracks-changes-to-content-in-Splunk/m-p/358574#M3500 john_glasscock 2017-05-02T12:59:45Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-there-an-Audit-log-that-tracks-changes-to-content-in-Splunk/m-p/358575#M3501 <P>absolutely,<BR /> great answers here:<BR /> <A href="https://answers.splunk.com/answers/387244/anyone-know-of-a-way-of-finding-the-last-modified.html">https://answers.splunk.com/answers/387244/anyone-know-of-a-way-of-finding-the-last-modified.html</A><BR /> <A href="https://answers.splunk.com/answers/317274/how-can-i-determine-who-modified-a-dashboard.html">https://answers.splunk.com/answers/317274/how-can-i-determine-who-modified-a-dashboard.html</A><BR /> there are more answers on this topic in this portal as well<BR /> look in _audit and _internal indexes.<BR /> you can narrow down by the correlation search name <BR /> hope it helps</P> Tue, 02 May 2017 13:10:38 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-there-an-Audit-log-that-tracks-changes-to-content-in-Splunk/m-p/358575#M3501 adonio 2017-05-02T13:10:38Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-there-an-Audit-log-that-tracks-changes-to-content-in-Splunk/m-p/358576#M3502 <P>Definitely, and I think Adonio is right: all depends what you're after. Given the circumstance you mentioned, audit.log &amp; searches.log (if they piped the output of a search to delete) should have a record. Happy splunking!</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.3/Troubleshooting/WhatSplunklogsaboutitself">http://docs.splunk.com/Documentation/Splunk/6.5.3/Troubleshooting/WhatSplunklogsaboutitself</A></P> Tue, 02 May 2017 16:06:50 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-there-an-Audit-log-that-tracks-changes-to-content-in-Splunk/m-p/358576#M3502 jimmccarthy 2017-05-02T16:06:50Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-there-an-Audit-log-that-tracks-changes-to-content-in-Splunk/m-p/358577#M3503 <P>John did you figure out how to do this?</P> Wed, 14 Feb 2018 14:22:39 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-there-an-Audit-log-that-tracks-changes-to-content-in-Splunk/m-p/358577#M3503 scannon4 2018-02-14T14:22:39Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-there-an-Audit-log-that-tracks-changes-to-content-in-Splunk/m-p/358578#M3504 <P>On Splunk Enterprise 7.0.3, I can see write to content objects using the following search:</P> <P>index=_internal sourcetype=splunkd_conf "data.task"=addCommit "data.optype_desc"=WRITE_STANZA</P> <P>The data.asse_uri field has the object that was changed and the data.payload has more details For<BR /> example, data.payload.children.search.value has the search string written to a report.</P> Wed, 30 Sep 2020 00:30:13 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-there-an-Audit-log-that-tracks-changes-to-content-in-Splunk/m-p/358578#M3504 esalesapns2 2020-09-30T00:30:13Z