Monitoring Splunk

Auditing who disabled/enabled alerts on a Search Head

Path Finder

I am trying to figure out how I can audit who disabled alerts on one of our search heads. I was thinking it is in the _audit index but have not been able to find the information I would expect.

I have enabled the alerts again as they need to be running but I do not see an entry in audit that shows I did that even.

This is likely just a search that I am not writing correctly.

Does anyone have a search that will show me alerts that were enabled/disabled during a time period and what user performed the action?


Labels (2)


_audit doesn't have as much information as one would expect. Try looking in splunkd_ui_access.log.

If this reply helps you, Karma would be appreciated.

Super Champion

Hi @richgalloway 

splunkd_ui_access.log also does not have good info.. something missing, something fishy.

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

Path Finder

I am not seeing in there what user that has made a change to the specific alert. (I did see the time window where I enabled a search that was disabled but it doesn't show my account doing it, and it was only showing it through the scheduler sourcetype as that meant it got rescheduled. The only user shown is the user that the alert was created with).

This does help me narrow down when it was changed to disabled but now who did it.

Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...