How to monitor and alert me via email when a Splunk admin makes config changes in Splunk?

[sbattista09]

I would like to monitor and alert when a Splunk admin makes config changes in Splunk and then have it shoot off an e-mail to me. I canot find where the logs are that would have this data. It seems I can only go so far with index=_audit.

For example;
I see action=edit_roles, but do not see what the user changed.
I see dashboards running under users but do not see who made edits to them.

Anyone else have this issues before or have set up config changes alerts for Splunk?
any input would be helpful.
thanks!

[gtriSplunk]

You can have Splunk monitor the XML and/or conf files under $SPLUNK_HOME/etc/apps for any changes. You can then create an alert to notify you if any events appear in the appropriate index. See Splunk's documentation:

http://docs.splunk.com/Documentation/Splunk/6.3.3/Data/Monitorchangestoyourfilesystem

[MuS]

hmmm, fschange is deprecated since Splunk 5.x and therefore could possibly disappear some when in the future. Also, from my point of view, the idea to have something watching itself is a bit - sorry - strange. If I want something to watch/monitor something, I would use a different software that uses external checks.

cheers, MuS

[masonmorales · Accepted solution]

If you want to see what is being changed in your Splunk environment, you need to setup a change control system. There was a session at Conf 2014 about Splunk Change Control Using GIT that you might want to take a look at. Here are the links:

• https://conf.splunk.com/session/2014/conf2014_VladimirHad_FirstData_Deploying.mp4
• https://conf.splunk.com/session/2014/conf2014_VladimirHad_FirstData_Deploying.pdf