Splunk audit setting

Recently, the company will check splunk audit The situation of

1: First look at audit Have you opened ：

2: notice audit It's open , Let's take a look at the official documents ：

audit.conf - Splunk Documentation

 

 3: The following audit close , test ：

$SPLUNK_HOME/etc/system/local/audit.conf

[default]
queueing = false
 

4: restart splunk, And then look index=_audit, Find out audit No logs come here .