Query to alert when there are some changes made in macros

[AmruthaSK]

Hi All,

We have created few macros with below definition and added the macro names in the important critical alerts.

```maintenance_window=true```

Here i want to alert whenever there are some changes made in Macro, particularly I want to alert team when the above definition is uncommented (which stop many of important alerts during maintenance). If someone forgets to comment it back.

How can I create an alert for looking at macro?

Thanks in Advance

Amrutha SK

[AmruthaSK]

Thanks @dural_yyz but I don't any results with the below query itself. is there any other way?

index=_configtracker

[dural_yyz]

It was only introduced in 9.x so prior versions of Splunk would not have that index and logging available.  Previous to this we had a script which would ingest the outputs of a btool command and then compare changes in values over time.

[AmruthaSK]

Is there any other way to try?

[isoutamo]

Hi

here is one way to do it (and lot other stuff) https://conf.splunk.com/files/2019/slides/FN1315.pdf. Unfortunately it needs that you have set up it before hand. Another way is use https://splunkbase.splunk.com/app/4355, but also it needs to set up before hand.

r. Ismo

[dural_yyz]

After Splunk 9.x they introduced "_configtracker" index to log changes to any files.

index=_configtracker data.path=*/macro.conf

Throw in some extras afterward to make it how you want. 

[AmruthaSK]

As the above did not work, is there way I can call macro and count number of strings, and any change in string which should throw an alert.