Splunk Search

How can i check to see if a Splunk dashboard has been edited?

voninski
New Member

I have a requirement to be able to check and provide alerts if a customers dashboards have been tampered with. I have found the following search

index=_* "edit"

seems to pick up edits (see screenshot).

Im just wondering if this is the best way to check for editing? Or if anyone can share with me their thoughts and findings in checking for edits to existing pages.

Thoughts.!

alt text

0 Karma
1 Solution

cmerriman
Super Champion

this is what i use:

index=_internal sourcetype=splunkd_ui_access method=post ui/views (edit OR editxml)
 | table user, req_time, file 
 | rename file as dashboard req_time as editTime

it gives me the user, the time of editing and what dashboard.

View solution in original post

cmerriman
Super Champion

this is what i use:

index=_internal sourcetype=splunkd_ui_access method=post ui/views (edit OR editxml)
 | table user, req_time, file 
 | rename file as dashboard req_time as editTime

it gives me the user, the time of editing and what dashboard.

voninski
New Member

This is perfect. Exactly what I was looking for. Thank you!

0 Karma

jat75
Explorer

I have found that I must remove the '(edit OR editXML)' part of the query and add 'NOT StreamedSearch' to get the actual results.

adonio
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...