@yazeed
Splunk's _configtracker can be used to monitor changes to alerts and saved searches in Splunk.
The _configtracker index:
With Splunk 9, the _configtracker index was introduced. This index stores changes to Splunk configuration files, including the date and time of the change, as well as all the new and old values associated with the modified item.
However, the data in _configtracker has a limitation: it only monitors changes to configuration files. Consequently, a crucial piece of information is missing from these logs: the user responsible for the change. While it does provide a record of the previous and updated settings, this information is not available in the same event. Therefore, to create a comprehensive alert, we need to perform data aggregation and enrichment.
For instance, after the described change to the Windows failed logons alert use case, the configtracker will contain two related events. Note the search looks in the _configtracker index, for a configuration update, where the changed item (data.changes{}.stanza) is specified, and particularly for a saved search being changed, independently of the app and Splunk installation directory ("*/savedsearches.conf").
Here is the SPL query:
index=_configtracker component=ConfigChange data.action=update data.changes{}.stanza=* data.path="*/savedsearches.conf"
