The configtracker feature of Splunk 9.x can help with that. Start with this query and modify it to suit your needs. index=_configtracker "data.path"=*savedsearches.conf
... View more
Hi @nihvk, good for you, see next time! Please accept one answer for the other people of Community Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉
... View more