Is it possible to retrace when and what was modified in a saved search?

[chris]

Hi

I would like to see when saved searches are modified and what their new values are.

I read that the execution of capabilietes listed in authorize.conf should generate an audit event (http://www.splunk.com/base/Documentation/4.1.4/admin/AuditSplunkActivity). I did not see any capability defined associated with editing saved searches. Is there a way to enable it or is this the wrong approach.

Thanks for helping me

Chris

[Lowell · Accepted solution]

I put all my apps in version control; which obviously includes the savedsearches.conf file.

This approach certainly requires more effort, but it also helps to recover if any weird things get changed. Also revision control gives the inherent ability to diffs and roll back. One thing that you can't really do is figure out "who" exactly, since everything is just in a text file so there's no real way of knowing who made what change if it was made from the web interface.

[chris]

Thanks. We were thinking about that, I was just wondering whether there was a way to do this built into splunk.

[jfraiberg]

Why not just add that file to splunk to watch. than you can do diffs on it every time it changes.