topic Re: How can i check to see if a Splunk dashboard has been edited? in Splunk Search

How can i check to see if a Splunk dashboard has been edited?

voninski — Tue, 30 May 2017 16:39:05 GMT

I have a requirement to be able to check and provide alerts if a customers dashboards have been tampered with. I have found the following search

index=_* "edit"

seems to pick up edits (see screenshot).

Im just wondering if this is the best way to check for editing? Or if anyone can share with me their thoughts and findings in checking for edits to existing pages.

Thoughts.!

Re: How can i check to see if a Splunk dashboard has been edited?

adonio — Tue, 30 May 2017 16:56:10 GMT

Re: How can i check to see if a Splunk dashboard has been edited?

cmerriman — Tue, 30 May 2017 17:47:05 GMT

this is what i use:

index=_internal sourcetype=splunkd_ui_access method=post ui/views (edit OR editxml)
 | table user, req_time, file 
 | rename file as dashboard req_time as editTime

it gives me the user, the time of editing and what dashboard.

Re: How can i check to see if a Splunk dashboard has been edited?

voninski — Tue, 30 May 2017 19:54:52 GMT

This is perfect. Exactly what I was looking for. Thank you!

Re: How can i check to see if a Splunk dashboard has been edited?

jat75 — Tue, 18 Jul 2017 15:11:05 GMT

I have found that I must remove the '(edit OR editXML)' part of the query and add 'NOT StreamedSearch' to get the actual results.