Monitoring Splunk

How do I find Splunk Cloud configuration change events?

lindonmorris
Explorer

With multiple admins in our Splunk Cloud, we'd like to see any changes made that have a global or app wide impact.

Example: I just deleted a field alias (was: cs_User_Agent_ == http_user_agent).

Searching _audit and _internal for either of those terms, the only results I can find is searches - I can't actually find the event where it was deleted.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...