Query to check tags activity

[Poojitha]

Hi All,

I have created few tags in splunk which are getting disabled automatically. I want to check using splunk query the time they are getting disabled. 

Please can anyone of you suggest me the query for this . I tried using REST but not getting exact details.

I also tried below but not seeing any related logs.

index=_internal sourcetype=splunk_audit action=edit status=disabled info=tags

Thanks in advance,
PNV

[ITWhisperer]

Have you tried looking in the _audit index?

index="_audit" action=disable_tag

[Poojitha]

@ITWhisperer  : I tried this. But I am not seeing any log for action=disable_tag. I am just seeing for action=enable_tag.