search

ChrisYounger / config_explorer

Config viewer and file editor for Splunk. Based on VSCode.
GNU Affero General Public License v3.0
28 stars 7 forks source link

Ability to see who saved a file change #16

Closed manderso7 closed 4 years ago

manderso7 commented 4 years ago

I see that I can save a file from the UI, which is great. But will there be a way to see who saved the file, and when? Version control is useful, but it's only going to show the file and it's ownership by the splunk user. Whenever we go to change a file in the cli, we do so as the splunk user, so this would be amazing to see. Please let me know if you have questions.

ChrisYounger commented 4 years ago

Yes this is a limitation of the way its been implemented. However there is logging that will show who saved a file. On the "home" tab there is a link at the bottom to "logging" which will take you to a search like so:

index=_internal source=*config_explorer.log

Hope this helps.

manderso7 commented 4 years ago

Yes thank you, that's what I needed.

manderso7 commented 4 years ago

Not sure if this should be in the same issue or not. If not, I apologize. I've noticed that in the config_explorer.log file, after a file is saved, there are additional fields in the event, param1 & reason, both are blank in all my save action events. Can I add values to these fields when I save the file in question using config_explorer? Thanks again

ChrisYounger commented 4 years ago

There is no configuration that allows changing what is logged.

However if you know python well you could try make modifications to etc/apps/config_explorer/bin/config_explorer.py

manderso7 commented 4 years ago

Ok, thank you.