Skip to main content
Preview. Audit streaming is available to organisations in the audit streaming pilot.
The Wordsmith Add-on for Splunk (TA-wordsmith) collects your organisation’s audit log in two ways. Both use the sourcetype wordsmith:audit, so searches work the same either way:
  • Polling. A modular input reads the audit feed on a schedule. It keeps its position in the KV store, so it resumes where it stopped after a restart.
  • Push. A Wordsmith Splunk HEC destination sends events to your HTTP Event Collector. Install the add-on on your search heads for the field extractions.
The add-on maps sign-ins to the CIM Authentication data model and administrative changes to the Change data model. It also includes example alerts and a Wordsmith audit log dashboard.

​
Set up polling

  1. In Wordsmith, sign in as a user with audit export permission (a dedicated service user is best), go to Settings > API keys, and create a key with the audit:read scope.
  2. Download the add-on from Settings > Audit log > Streaming. Install it where your inputs run (a heavy forwarder, or your Splunk Cloud stack) and on your search heads.
  3. In the add-on, open Configuration > Account and add your region and API key.
  4. Open Inputs and add a Wordsmith audit feed input. Choose the account and an index. Leave Start time empty to collect the last 24 hours on the first run, or enter an RFC3339 time such as 2026-10-01T00:00:00Z.
  5. Edit the wordsmith_audit_events macro so it names your index, for example index=wordsmith sourcetype="wordsmith:audit".

​
How the input behaves

  • It waits for the Retry-After time when Wordsmith rate-limits it.
  • If Wordsmith rejects its cursor, the input logs a warning and restarts from the time of the last event it collected.
  • If the API key is revoked, or its owner loses audit export permission, the input logs an error in ta_wordsmith_*.log and retries on the next run.

​
Searching

Delivery is at-least-once, so deduplicate on event_id:
action holds the CIM value (for example success, failure, created, modified). The Wordsmith action name, such as member.updated, is in wordsmith_action. Events name the fields that changed (changes{}.field) but never their old or new values. The example alerts under Searches, reports, and alerts ship disabled. Enable the ones you want and tune their thresholds.