Reporting

Is it possible to retrace when and what was modified in a saved search?

Motivator

Hi

I would like to see when saved searches are modified and what their new values are.

I read that the execution of capabilietes listed in authorize.conf should generate an audit event (http://www.splunk.com/base/Documentation/4.1.4/admin/AuditSplunkActivity). I did not see any capability defined associated with editing saved searches. Is there a way to enable it or is this the wrong approach.

Thanks for helping me

Chris

0 Karma
1 Solution

Super Champion

I put all my apps in version control; which obviously includes the savedsearches.conf file.

This approach certainly requires more effort, but it also helps to recover if any weird things get changed. Also revision control gives the inherent ability to diffs and roll back. One thing that you can't really do is figure out "who" exactly, since everything is just in a text file so there's no real way of knowing who made what change if it was made from the web interface.

View solution in original post

Super Champion

I put all my apps in version control; which obviously includes the savedsearches.conf file.

This approach certainly requires more effort, but it also helps to recover if any weird things get changed. Also revision control gives the inherent ability to diffs and roll back. One thing that you can't really do is figure out "who" exactly, since everything is just in a text file so there's no real way of knowing who made what change if it was made from the web interface.

View solution in original post

Motivator

Thanks. We were thinking about that, I was just wondering whether there was a way to do this built into splunk.

0 Karma

Communicator

Why not just add that file to splunk to watch. than you can do diffs on it every time it changes.

0 Karma