Getting Data In

How do you audit for who is disabling Data Input?

New Member

Recently, we found one data input for receiving syslog was stopped.

We don't know if the service issue is auto stop or someone disabling it. i tried to search index=_audit,

Also, I even saw some log edit server, only see the action is edit server but it didn't mention what setting had been changed.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>