My customer want me to provide a change log on saved searches/dashboards/macros etc.
I.e.: Change date, changed by user, old search content, new search content.
The same apply to dashboards, macros etc.
Where can I find this log?
I have read through the above documentation - but I did not find anything about audit trail on change on saved searches/dashboards/macros etc.
Does this mean that no such audittrail exist?
Changes to the app configuration files are monitored but i'm not sure if you'll get all of that detail in the audit event.
Audit events are generated from monitoring:
all files in Splunk's configuration directory $SPLUNK_HOME/etc/* files are monitored for add/change/delete using the file system change monitor.