configuration_change.log is not enabled by default- Splunk not logging anything into that log?

[glpadilla_sol]

Hello everyone,

I have been reading about the way Splunk can audit the changes at the configuration files and I found this as a possibility

https://docs.splunk.com/Documentation/Splunk/8.2.2/Troubleshooting/WhatSplunklogsaboutitself

But even though the documentation said is enabled by default my Splunk instance is not logging anything into that log

Do you know what I should be doing to track it?

Current Version 8.2.2

Cluster environment

Linux

Thank you in advance.

[glpadilla_sol]

Thank you so much!

[jamie00171 · Accepted solution]

Hi @glpadilla_sol 

The default actually seems to be :

[config_change_audit]
disabled = true
mode = auto

in 8.2.2 from: https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Serverconf#Configuration_Change_Audit

so you'll need to set that to false to enable it.

Thanks, 

Jamie