Getting Data In
Highlighted

Change log on searches/dashboards/macros etc.?

Communicator

My customer want me to provide a change log on saved searches/dashboards/macros etc.

I.e.: Change date, changed by user, old search content, new search content.

The same apply to dashboards, macros etc.

Where can I find this log?

Tags (1)
0 Karma
Highlighted

Re: Change log on searches/dashboards/macros etc.?

Splunk Employee
Splunk Employee

This will give you the details on what activity is logged for users in Splunk.

http://docs.splunk.com/Documentation/Splunk/latest/admin/AuditSplunkactivity

0 Karma
Highlighted

Re: Change log on searches/dashboards/macros etc.?

Communicator

I have read through the above documentation - but I did not find anything about audit trail on change on saved searches/dashboards/macros etc.

Does this mean that no such audittrail exist?

0 Karma
Highlighted

Re: Change log on searches/dashboards/macros etc.?

Splunk Employee
Splunk Employee

Changes to the app configuration files are monitored but i'm not sure if you'll get all of that detail in the audit event.

Audit events are generated from monitoring:

all files in Splunk's configuration directory $SPLUNK_HOME/etc/*
    files are monitored for add/change/delete using the file system change monitor.
0 Karma