How can we monitor if user changes or updates or deletes any file from any of the Splunk Servers?

[sharonjo]

How can we monitor if user changes or updates or deletes any file from any of the Splunk Servers?

[jcrabb_splunk]

Here is a document that covers what Splunk logs about itself.

• http://docs.splunk.com/Documentation/Splunk/6.5.3/Troubleshooting/WhatSplunklogsaboutitself

If you look at the contents on the left, you will see additional pages you may want to review. You may also want to test different actions and then review the Splunk logs to see what type of event is generated for that action. You can use that to build alerts or dashboards if you deem it necessary.

[adonio]

windows or nix?
do you collect that data from the server?