Getting Data In

Splunk 5.0.5, Does Splunk logs object deletion activity from Splunk Web ?

somesoni2
SplunkTrust
SplunkTrust

Hi,

We have a shared development environment for Splunk (version 5.0.5) where many users do create/updated/delete Splunk objects (e.g. saved searches/views/lookups etc).

Does Splunk logs any information in any internal logs for who created (not imp at this point)/deleted (this is what I want to know for sure)/updated any of the objects? Something like auditing Splunk Web activities.

Appreciate your help.

Tags (2)
1 Solution

rahulroy_splunk
Path Finder

This seems to be working for deleted items.

index=_internal sourcetype=splunkd_access method="DELETE"

I'm too looking for "UPDATE" but no luck so far.

View solution in original post

rahulroy_splunk
Path Finder

This seems to be working for deleted items.

index=_internal sourcetype=splunkd_access method="DELETE"

I'm too looking for "UPDATE" but no luck so far.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...