Monitoring Splunk

How do I find Splunk Cloud configuration change events?

lindonmorris
Explorer

With multiple admins in our Splunk Cloud, we'd like to see any changes made that have a global or app wide impact.

Example: I just deleted a field alias (was: cs_User_Agent_ == http_user_agent).

Searching _audit and _internal for either of those terms, the only results I can find is searches - I can't actually find the event where it was deleted.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...