Hello there, First off, im new to Splunk and im evaluating  if all our auditing / monitoring / reporting needs can be satisfied by splunk. My test setup is 1x Enterprise standalon + 1 universal forwarder on 2 different machines. Im currently trying to audit changes on a configuration file, idealy i'd like to log which user changed it, and what exactly was changed. For a start i tried :   [monitor://C:\Tests\Splunk\Audit_Config_Test\test.conf] sourcetype = config_audit disabled = false interval = 10      Which lets splunk index either the compelte file if a change was made somewhere, or only the last line of it, if something was appended. Is there any way to only index the actual changes? If not, that it always indexes the whole file? As for the user changing the file, does splunk come with tools to figure that out or do i need to script something myself? The final goal is to achieve  transparency and traceability in case anything happens somewhere in the future. ... View more