How to search for all recently modified or new scheduled searches and dashboards?

[p1stolero]

Is it possible to search for all recently modified or new scheduled searches and dashboards? I've seen several examples using REST to retrieve saved search attributes, but nothing that helps me identify if it's new or modified. I figure this can be done searching against the _internal or _audit indexes, but I haven't been able to connect the dots.

Requested Table Format

Timestamp, App, User, Status, Type, Title
10/13/2015:13:38:00 | Search | Juan | New | Scheduled Search | Webserver_Errors
10/13/2015:14:22:00 | myApp | Steve | Modified | Dashboard | User_Transactions

[somesoni2]

Try something like this

index=_internal sourcetype=splunkd_ui_access method=POST NOT "/search/jobs" "/saved/searches" OR "data/ui/views" | table _time user uri | rex field=uri "(\/[^\/]+){5}\/(?<app>[^\/]+)\/\w+(\/ui)*\/(?<type>[^\/]+)\/(?<title>.*)" | fields - uri

[Yasaswy]

hi,
I am not sure if the exact info is in the above indexes and if it's easy enough to extract with a single search. That being said, the REST calls that you referenced above can help with this requirement. There might be simpler ways to do this, but one way I think of would be to:
-- write the current saved search titles and searches to a look up table (schedule this per your requirement).
eg:
|rest /servicesNS/-/-/saved/searches|search splunk_server=yourSearchHead AND disabled=0|fields title,qualifiedSearch|outputlookup ssearches.csv

--schedule another search to look for searches not in this list and alert you (schedule per your requirement... time it accordingly with above search)
eg:
|rest /servicesNS/-/-/saved/searches|search splunk_server=yourSearchHead AND disabled=0|fields title|search NOT [ inputlookup ssearches.csv| fields title ]

you can use the same process to look for modification as well (...fields qualifiedSearch)