Monitoring Splunk

Log showing when Diags were generated?

chadmedeiros
Path Finder

I've been trying to find an _internal or _audit trail log event showing when a Splunk Diag was created on a given server but have been unable to find anything in those indexes nor any documentation around it... 

Often for troubleshooting case tickets with Splunk support it becomes important to know when a diag was created on a server in the context of the timeline of the issue. The goal we have is to simply timechart critical events, including diag generation, by server/host so we can visualize what happened in what order. 

Anyone have any experience with this?

Labels (2)
0 Karma

nunoaragao
Path Finder

Agree @chadmedeiros there is no event log for the export of a diag.

The issue was made worse when Splunk replaced their Support Portal, and the new portal doesn't show customers their own uploaded files. They claim the old one never did, so, until I can prove them they'll just log that as a suggestion. Does anyone keep a screenshot of the old portal with the uploaded files section right below the description? Thanks.

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...