audit.conf
The following are the spec and example files for audit.conf
.
audit.conf.spec
# Version 9.0.1 # # This file contains possible attributes and values you can use to configure # auditing in audit.conf. # # There is NO DEFAULT audit.conf. To set custom configurations, place an # audit.conf in $SPLUNK_HOME/etc/system/local/. For examples, see # audit.conf.example. You must restart Splunk to enable configurations. # # To learn more about configuration files (including precedence) please see the # documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles
GLOBAL SETTINGS
# Use the [default] stanza to define any global settings. # * You can also define global settings outside of any stanza, at the top of the file. # * Each conf file should have at most one default stanza. If there are # multiple default stanzas, attributes are combined. In the case of multiple # definitions of the same attribute, the last definition in the file wins. # * If an attribute is defined at both the global level and in a specific # stanza, the value in the specific stanza takes precedence. queueing = <boolean> * Whether or not audit events are sent to the indexQueue. * If set to "true", audit events are sent to the indexQueue. * If set to "false", you must add an inputs.conf stanza to tail the audit log for the events reach your index. * Default: true
audit.conf.example
# Version 9.0.1 # # This is an example audit.conf. Use this file to configure auditing. # # There is NO DEFAULT audit.conf. # # To use one or more of these configurations, copy the configuration block into # audit.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to # enable configurations. # # To learn more about configuration files (including precedence) please see the # documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles
app.conf | authentication.conf |
This documentation applies to the following versions of Splunk® Enterprise: 9.0.1
Feedback submitted, thanks!