Solved: How to create alerts for changes made on config fi...

rcreddy06 · ‎10-09-2015

In a corporate environment with multiple users, If someone changes a config file (lets say inputs.conf/server.conf). How to setup an alert for this scenario. How to find the user who did this?

Or

How to audit user activity and generate alerts when a critical file is modified?

rroberts · ‎10-09-2015

Splunk OOTB creates an audit trail in the audit index on config files:
index=_audit sourcetype=audittrail *.conf NOT action=search

You could create an alert off this search and you could also specifiy action values like add, update or delete.

View solution in original post

rroberts · ‎10-09-2015

Splunk OOTB creates an audit trail in the audit index on config files:
index=_audit sourcetype=audittrail *.conf NOT action=search

You could create an alert off this search and you could also specifiy action values like add, update or delete.

How to create alerts for changes made on config files.

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Splunk Auto Ingestion Parallel Pipeline Scaling

Join the Conversation