Monitoring Splunk

How to get the data related to creation, modification, deletion of a particular index

Explorer

Hi,

I want to check when the index was created, modified or deleted from internal logs(also other details of this particular operation). Is there any way to query this data?

Labels (1)
Tags (1)
0 Karma
1 Solution

Hi,

Try the below search query,
- the first part will give details regarding action performed on Index (create, edit, remove)
- subquery after join will provide the parameter and other details for the action

index=_audit action=indexes_edit operation IN (create, edit, remove) 
| rename object as idx 
| bin span=1m _time 
| join type=outer _time, idx 
    [ search index=_internal params=* 
    | bin span=1m _time 
    | stats first(params) as params by _time, idx]
| table _time, user, operation, idx, params

accept & up-vote the answer if it helps.

View solution in original post

Hi,

Try the below search query,
- the first part will give details regarding action performed on Index (create, edit, remove)
- subquery after join will provide the parameter and other details for the action

index=_audit action=indexes_edit operation IN (create, edit, remove) 
| rename object as idx 
| bin span=1m _time 
| join type=outer _time, idx 
    [ search index=_internal params=* 
    | bin span=1m _time 
    | stats first(params) as params by _time, idx]
| table _time, user, operation, idx, params

accept & up-vote the answer if it helps.

View solution in original post