How to find out when SavedSearches have been edited?

[thommu]

I have this requirement to check if saved searches have been edited.

I looked through _internal but only saw information about searches running under scheduler. It didn't display the query for me to check if it changed.

After looking through the forums, I found the REST command | rest /services/saved/searches
This displayed all the queries for each search, but It seems to show only the current query, rather than a history of changes.

Is this something Splunk logs within itself?

[renatobamorim]

Another way is run this search

index=_internal sourcetype=splunkd_conf data.asset_uri{}=savedsearches

When any rule is changed the data.optype_desc field receive the WRITE_STANZA value.

[p_gurav]

Hi,

You can try this search, its for all changes, you can modify according to your requirements:

index=_internal sourcetype=splunkd_access
 ( method=POST OR method=DELETE )
 ( user!=sandy user!=splunk-system-user )
 ( uri_path=/servicesNS/* uri_path!="*/user-prefs/*" uri_path!="/servicesNS/*/*/*/jobs/*/control" uri_path!=/servicesNS/*/mobile_access* )
  | replace "*/ui/views*" with "*/ui_views*", "*/props*" with "**", "*/distributed/peers*" with "*/distributed_peers*", "*/server/serverclasses*" with "*/server_class*" in uri_path
  | where mvcount( split( uri_path , "/" ) ) > 6
  | eval activity = case( method=="POST" AND like( uri_path , "%/acl" ) , "Permissions Update", method=="POST" AND NOT like( uri_path , "%/acl" ) , "Edited" , method="DELETE" , "Deleted" )
  | rex field=uri_path "/servicesNS(/[^\/]+){3}/(?<object_type>[^\/]+)/(?<object_name>[^\/]+)"
  | eval object_name = urldecode( object_name )
  | table _time, user, object_name, object_type, activity

[thommu]

Awesome, this is perfect!

Any chance the _internals will tell me what those queries were at the time of the edit?