Splunk Search

What can I search for in _internal data to monitor/audit Splunk admin activities?

Path Finder

HI Team,

I am trying to configure some alerts for tracking all Splunk admin activities like mentioned below where changes are performed via UI or command line. Logs available in _audit index are very inadequate as it only gives info about actions performed, but not about who performed the action and other info. Please advise some sample searches or keywords to search in _internal logs or other places for following Splunk admin activities

  • Splunk user Account creation/deletion/modification
  • New index creation /deletion
  • splunk restart
  • change any config file
  • crate role/app etc
0 Karma

Ultra Champion

Hi thezero,
Here are some seaerches that answer your questions above:

Splunk user Account creation/deletion/modification
index = _audit user=admin action=edit_user operation= | table _time user operation object*
create / modify role
index="_audit" action=edit_roles operation= | table _time user operation object*

New index creation /deletion
index = _audit user=admin action=indexes_edit
index = _internal component=IndexWriter message="*Initializing" component=IndexWriter | table _time idx | rename idx as "New Index"*
Index Removed
index = _audit user=admin action=indexes_edit object= | table user action object*

Splunk restart
index=_internal source=*splunkd.log "(build"*


Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...