Audit Logs in Splunk On-Call and thier Retention Policies

Applicability

Description

This article explains the two ways to access audit log information in Splunk On-Call and outlines the retention policies for each type:

1. Reports Available within Splunk On-Call:

Team and user reports can be generated directly by navigating to the Reports tab in the Splunk On-Call interface. The user list can also be exported from the Reports tab.

2. Reports Provided by Splunk On-Call Support:

Splunk On-Call Support can supply reports related to user login activities upon request.

Retention policies for both types of audit logs are also described.

Investigation

The review has identified two primary categories of logs in Splunk On-Call: Reports Accessible within Splunk On-Call and User Login Activity Reports. 

Resolution

Splunk On-Call offers two main types of audit logs, each with its own access method and retention policy:

1. User-Accessible Reports in Splunk On-Call:

Post Incident Reviews, Response Metrics, On-Call Review, and Incident Frequency for the teams and users, these can be provided in .CSV format. The user list can also be exported by navigating to the Reports tab.

Retention Policy: Available for up to 13 months.

2. User Login Activity Reports Provided by Support:

Records such as user logins, account creation or deletion, on-call rotation events, and escalation policy lists can be provided in .CSV format. These logs are available for the period when the instance started and when it ended. For specific inquiries, such as identifying who deleted a user or who was removed from a rotation, screenshots can be provided from Splunk logs. These logs are available for up to the past 12 months.