Splunk Search

How to find out who deleted savedsearches

lucas4394
Path Finder

We found there were some savedsearches deleted for some reasons. Is it a way to find out who deleted the savedsearches from Splunk?

Thanks.

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Start with index=_internal sourcetype=splunkd_ui_access method=DELETE and see if that offers any clues.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

efavreau
Motivator

This answer points you to a comprehensive solution that not only can answer your question, but also a series of follow-up questions.

@dmarling and I ( @efavreau ) presented a way to export, audit, and import your knowledge objects (which includes saved searches), in a presentation at Splunk .Conf19. That way, if someone deletes them, you know who did it, you have an export you can go back to, and can import your last good source - all without having to involve your admins. Here's a link to the presentation video and slides:
https://conf.splunk.com/watch/conf-online.html?search=FN1315#/

We also put our code up in Github. In the video, a demo is given showing that with little modification, you can use these queries in a short period of time. So after you watch the video, you can get the code and use it. Here's the github link:
https://github.com/paychex/Splunk.Conf19/

There's a caveat, the ability to do the audit with the details we show, depends on you having access to the _internal and _audit logs, which your admins may or may not have given you access to.

Good Luck!

###

If this reply helps you, an upvote would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

Start with index=_internal sourcetype=splunkd_ui_access method=DELETE and see if that offers any clues.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...