Splunk Search

How to search for all recently modified or new scheduled searches and dashboards?

p1stolero
Explorer

Is it possible to search for all recently modified or new scheduled searches and dashboards? I've seen several examples using REST to retrieve saved search attributes, but nothing that helps me identify if it's new or modified. I figure this can be done searching against the _internal or _audit indexes, but I haven't been able to connect the dots.

Requested Table Format

Timestamp, App, User, Status, Type, Title
10/13/2015:13:38:00 | Search | Juan | New | Scheduled Search | Webserver_Errors
10/13/2015:14:22:00 | myApp | Steve | Modified | Dashboard | User_Transactions

somesoni2
SplunkTrust
SplunkTrust

Try something like this

index=_internal sourcetype=splunkd_ui_access method=POST NOT "/search/jobs" "/saved/searches" OR "data/ui/views" | table _time user uri | rex field=uri "(\/[^\/]+){5}\/(?<app>[^\/]+)\/\w+(\/ui)*\/(?<type>[^\/]+)\/(?<title>.*)" | fields - uri
0 Karma

Yasaswy
Contributor

hi,
I am not sure if the exact info is in the above indexes and if it's easy enough to extract with a single search. That being said, the REST calls that you referenced above can help with this requirement. There might be simpler ways to do this, but one way I think of would be to:
-- write the current saved search titles and searches to a look up table (schedule this per your requirement).
eg:
|rest /servicesNS/-/-/saved/searches|search splunk_server=yourSearchHead AND disabled=0|fields title,qualifiedSearch|outputlookup ssearches.csv

--schedule another search to look for searches not in this list and alert you (schedule per your requirement... time it accordingly with above search)
eg:
|rest /servicesNS/-/-/saved/searches|search splunk_server=yourSearchHead AND disabled=0|fields title|search NOT [ inputlookup ssearches.csv| fields title ]

you can use the same process to look for modification as well (...fields qualifiedSearch)

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...