My customer want me to provide a change log on saved searches/dashboards/macros etc.
I.e.: Change date, changed by user, old search content, new search content.
The same apply to dashboards, macros etc.
Where can I find this log?
This will give you the details on what activity is logged for users in Splunk.
http://docs.splunk.com/Documentation/Splunk/latest/admin/AuditSplunkactivity
Changes to the app configuration files are monitored but i'm not sure if you'll get all of that detail in the audit event.
Audit events are generated from monitoring:
all files in Splunk's configuration directory $SPLUNK_HOME/etc/* files are monitored for add/change/delete using the file system change monitor.
I have read through the above documentation - but I did not find anything about audit trail on change on saved searches/dashboards/macros etc.
Does this mean that no such audittrail exist?
