Is there a way to audit the trail to the correlation search edit?

[l00111533]

Is there a way to audit trail to the correlation search edit?
Finding out who and when and what has been changed to the correlation search.

[amitpanjawani]

I was searching for the same, then i developed this app for the community. https://splunkbase.splunk.com/app/4144/

Hope it helps!

[adonio]

hello there, can you kindly elaborate?
what is it that you are after? what is the problem you are trying to solve?
if you want to know who modified saved searches in splunk there are many answers in this portal on this subject
heres an example: https://answers.splunk.com/answers/318093/how-to-search-for-all-recently-modified-or-new-sch.html

[l00111533]

Hi there,

Let say in splunk ES allow you to edit the "Rule for Expected Host Not Reporting" from the notable Severtiy High to Low. How can I get an alert if someone change that.

https://docs.splunk.com/Documentation/ES/5.2.2/Admin/Configurecorrelationsearches

I am able to use the following query obtain GET request but no POST request able to obtain
| from datamodel:"splunk_Audit"."View_Activity" | search view="correlation_search_edit"