Monitoring Splunk

How to get the data related to creation, modification, deletion of a particular index

gndivya
Explorer

Hi,

I want to check when the index was created, modified or deleted from internal logs(also other details of this particular operation). Is there any way to query this data?

Labels (1)
Tags (1)
0 Karma
1 Solution

gaurav_maniar
Builder

Hi,

Try the below search query,
- the first part will give details regarding action performed on Index (create, edit, remove)
- subquery after join will provide the parameter and other details for the action

index=_audit action=indexes_edit operation IN (create, edit, remove) 
| rename object as idx 
| bin span=1m _time 
| join type=outer _time, idx 
    [ search index=_internal params=* 
    | bin span=1m _time 
    | stats first(params) as params by _time, idx]
| table _time, user, operation, idx, params

accept & up-vote the answer if it helps.

View solution in original post

gaurav_maniar
Builder

Hi,

Try the below search query,
- the first part will give details regarding action performed on Index (create, edit, remove)
- subquery after join will provide the parameter and other details for the action

index=_audit action=indexes_edit operation IN (create, edit, remove) 
| rename object as idx 
| bin span=1m _time 
| join type=outer _time, idx 
    [ search index=_internal params=* 
    | bin span=1m _time 
    | stats first(params) as params by _time, idx]
| table _time, user, operation, idx, params

accept & up-vote the answer if it helps.

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...