Where can I find Splunk logs for Content management in Splunk Enterprise security?

[yourfriend]

Hello Team,

In our environment, we have created use cases in the content management in Splunk ES. We want to know the query to search for the logs if anyone with Admin access made any changes in the use cases by mistake.

I will explain in detail, someone with admin access had made a change in the use case. To check who changed it, I was trying in splunk _internal with query,
index="_internal" sourcetype=*content_management*
But i am not getting any useful data with this query. 

Please kindly help me where all logs stored for content management(use cases) in Enterprise security.

How to search those logs, if anyone have any idea with query pls let me help with it.

We have to check the internal logs for the changes being made in the content management.

Thanks in advance. Bye Bye !

[Azeemering · Accepted solution]

Start with this:

index=_internal "<searchName>" sourcetype=splunkd_ui_access source="*splunkd_ui_access.log" "POST"

 Then theres is a REST search:

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

But I would check out the Correlation Search Audit app for this:

https://splunkbase.splunk.com/app/4144/

And that uses an amazingly good search that I use too:

| multisearch[ search index=_internal sourcetype=splunkd_ui_access splunkd servicesNS saved searches method=POST| regex uri="/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/[^/ ]*$"| rex field=uri "/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/(?<search_encoded>[^/\? ]*)"| eval Title=urldecode(search_encoded)| rename user as "Last Modified By"| eval "Last Modified Time"=strftime(_time,"%b %d, %I:%M %p")| fields Title "Last Modified By" "Last Modified Time"][ search earliest=-30d@d latest=@d index=notable| search eventtype!=notable_suppression*| rename search_name as Title| eval isNotable = 1| fields isNotable Title| fields - _raw] | append[| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches| where match('action.correlationsearch', "1|[Tt]|[Tt][Rr][Uu][Ee]") OR match('action.notable', "1|[Tt]|[Tt][Rr][Uu][Ee]")| where disabled=0| eval Enabled=if(disabled=0,"Yes","No")| rename action.correlationsearch.enabled as enabled, action.notable.param.rule_description as Description, title as Title , author as Author| fields Title Enabled Author] | stats values(*) as * sum(isNotable) as notableCount by Title | eval "Triggered in past 30 days"=if(notableCount>0,notableCount,"No") | search Author=* | streamstats count as Number | lookup update=true correlationsearches_lookup _key as Title OUTPUTNEW rule_name as "Rule Name" | table Number Title "Rule Name" Enabled Author "Last Modified By" "Last Modified Time" "Triggered in past 30 days"