Splunk Enterprise Security

Where is the log that shows when a ES correlated search is created, edited, or disabled?

DEAD_BEEF
Builder

I'd like to create an auditing like dashboard panel that shows the user, the name of the correlated rule, the action (creation, deletion, edit, enable/disable). I have looked around in the _* indexes and can't find it. Can someone point me in the right direction?

0 Karma

lakshman239
Influencer

Did you try :

|rest /servicesNS/-/-/saved/searches splunk_server=local

This would show the owner, search, description, status etc.. and you can choose the fields that are of interest to you.

0 Karma

p_gurav
Champion

Did you search for _audit index?

Also you can use this app:
https://splunkbase.splunk.com/app/4144/

David
Splunk Employee
Splunk Employee

+1 on this app! @DEAD_BEEF you could grab the search from the app and use it to suit your needs as well.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...