Splunk 5.0.5, Does Splunk logs object deletion activity from Splunk Web ?

[somesoni2]

Hi,

We have a shared development environment for Splunk (version 5.0.5) where many users do create/updated/delete Splunk objects (e.g. saved searches/views/lookups etc).

Does Splunk logs any information in any internal logs for who created (not imp at this point)/deleted (this is what I want to know for sure)/updated any of the objects? Something like auditing Splunk Web activities.

Appreciate your help.

[rahulroy_splunk · Accepted solution]

This seems to be working for deleted items.

index=_internal sourcetype=splunkd_access method="DELETE"

I'm too looking for "UPDATE" but no luck so far.