How can I determine who modified a dashboard?

[a212830]

Hi,

I have a customer who needs to know who/when a dashboard was last modified. Is this possible?

[jaxjohnny2000]

try this: Better Audit Logs | Ideas (splunk.com)

[adm_rashi]

How can I get to know if any of my scheduled alerts have been modified, deleted or anyone created a new alert?

i tried the above query and got the results as well for index=_internal but not for index=_audit.

Also my main concern is about the activity performed on existing Alerts.

[Richfez]

Thank you, adm_rashi - I see you've also created your own question out of this. That's much more effective. 🙂

[sloshburch]

I think is more in line with what you're looking for. It shows who updated or deleted any knowledge object. It breaks out the different portions so you can throw it into a form dashboard for filtering.

index=_internal sourcetype=splunkd_access
( method=POST OR method=DELETE )
( user!=splunk-system-user user!=- )
( uri_path=/servicesNS/* uri_path!="*/user-prefs/*" uri_path!="/servicesNS/*/*/*/jobs/*/control" uri_path!=/servicesNS/*/mobile_access* )
 | replace "*/ui/views*" with "*/ui_views*", "*/props*" with "**", "*/distributed/peers*" with "*/distributed_peers*", "*/server/serverclasses*" with "*/server_class*" in uri_path
 | where mvcount( split( uri_path , "/" ) ) > 6
 | eval activity = case( method=="POST" AND like( uri_path , "%/acl" ) , "Permissions Update", method=="POST" AND NOT like( uri_path , "%/acl" ) , "Edited" , method="DELETE" , "Deleted" )
 | rex field=uri_path "/servicesNS(/[^\/]+){3}/(?<object_type>[^\/]+)/(?<object_name>[^\/]+)"
 | eval object_name = urldecode( object_name )
 | table _time, user, object_name, object_type, activity

[woodcock]

Take a look at this answer (question) and it should give you a good start:

http://answers.splunk.com/answers/316312/ever-wonder-which-dashboards-are-being-used-and-wh.html

[asimagu]

you could check

index=_audit sourcetype=audittrail

then, take a look at the actions field. It may be there what you are trying to find

[jonaclough]

I tried the suggestions above. The SPL against the _internal index doesn't show modifications to dashboards. The SPL against the _audit index does but it shows a numeric ID for the user which I believe to be unrelated to the actual user. I say this as because this same ID is responsible for 99% of action=modify events across the platform. So I would presume it to be the splunk system user.