We are running a slightly older version of Splunk (4) on Centos 5.5.
I have looked around but was just wondering if the actions taken by an gui admin are logged anywhere.
ie John Smith removed server x from tag list Y?
You should be able to find all of this information in the _audit index. All actions performed in Splunk are logged there, including admin activity.
index=_audit
For more info and examples, check the docs here: http://docs.splunk.com/Documentation/Splunk/latest/Security/AuditSplunkactivity
