- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there a way to monitor Splunk knowledge object permissions?
adityapavan18
Contributor
07-13-2015
10:06 PM
I am trying to generate report daily to monitor changes in knowledge objects (changes in permissions/new artifacts created/deleted/edited so on...) in Splunk. Is there any place they will be logged?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![woodcock woodcock](https://community.splunk.com/legacyfs/online/avatars/1493.jpg)
woodcock
Esteemed Legend
07-16-2015
11:11 PM
You can get a list of all the KOs you care about like this:
|rest/services/configs/conf-macros | eval config="macros" | append [|rest/services/configs/conf-lookups | eval config="lookups"] | append ...
Then you can examine the permission fields you care about and export them to a file with outputlookup
. Run this search every day and schedule another search to run just before you overwrite it, that checks the values now and look for differences.
![](/skins/images/FE4825B2128CA5F641629E007E333890/responsive_peak/images/icon_anonymous_message.png)