Reporting

Is it possible to retrace when and what was modified in a saved search?

chris
Motivator

Hi

I would like to see when saved searches are modified and what their new values are.

I read that the execution of capabilietes listed in authorize.conf should generate an audit event (http://www.splunk.com/base/Documentation/4.1.4/admin/AuditSplunkActivity). I did not see any capability defined associated with editing saved searches. Is there a way to enable it or is this the wrong approach.

Thanks for helping me

Chris

0 Karma
1 Solution

Lowell
Super Champion

I put all my apps in version control; which obviously includes the savedsearches.conf file.

This approach certainly requires more effort, but it also helps to recover if any weird things get changed. Also revision control gives the inherent ability to diffs and roll back. One thing that you can't really do is figure out "who" exactly, since everything is just in a text file so there's no real way of knowing who made what change if it was made from the web interface.

View solution in original post

Lowell
Super Champion

I put all my apps in version control; which obviously includes the savedsearches.conf file.

This approach certainly requires more effort, but it also helps to recover if any weird things get changed. Also revision control gives the inherent ability to diffs and roll back. One thing that you can't really do is figure out "who" exactly, since everything is just in a text file so there's no real way of knowing who made what change if it was made from the web interface.

chris
Motivator

Thanks. We were thinking about that, I was just wondering whether there was a way to do this built into splunk.

0 Karma

jfraiberg
Communicator

Why not just add that file to splunk to watch. than you can do diffs on it every time it changes.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...