Hi
I would like to see when saved searches are modified and what their new values are.
I read that the execution of capabilietes listed in authorize.conf should generate an audit event (http://www.splunk.com/base/Documentation/4.1.4/admin/AuditSplunkActivity). I did not see any capability defined associated with editing saved searches. Is there a way to enable it or is this the wrong approach.
Thanks for helping me
Chris
I put all my apps in version control; which obviously includes the savedsearches.conf
file.
This approach certainly requires more effort, but it also helps to recover if any weird things get changed. Also revision control gives the inherent ability to diffs and roll back. One thing that you can't really do is figure out "who" exactly, since everything is just in a text file so there's no real way of knowing who made what change if it was made from the web interface.
I put all my apps in version control; which obviously includes the savedsearches.conf
file.
This approach certainly requires more effort, but it also helps to recover if any weird things get changed. Also revision control gives the inherent ability to diffs and roll back. One thing that you can't really do is figure out "who" exactly, since everything is just in a text file so there's no real way of knowing who made what change if it was made from the web interface.
Thanks. We were thinking about that, I was just wondering whether there was a way to do this built into splunk.
Why not just add that file to splunk to watch. than you can do diffs on it every time it changes.