Deployment Architecture

Is there a log of changes that have been made to a splunk instance?

AlexWebber
Engager

A couple people have been given admin access to our splunk instance. Now I am getting messages that a change has been made that requires a restart and no one seems to know what has happened. Is there a log of changes made or another way to determine the changes that have been made that now require this restart?

Tags (3)
0 Karma

somesoni2
Revered Legend

Give this a try.

index=_internal sourcetype=splunkd "*required a restart*"
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.