Realistically, though, this is an audit/compliance problem like any other. If you really need this kind of auditing, the answer is to have your splunk instances forward _internal and _audit to another set of splunk instances, to which users on the production instances have no access. You'd then have a different set of trusted users who have access to the audit instances, and those users will audit the activity of the production users. Standard compliance practice: establish controls, record activity elsewhere, and use out-of-band auditors. ... View more

Ah, perfect. Thanks! ... View more