ko_history

KO History captures and versions Splunk knowledge objects through summary indexing, providing administrators with an audit trail and recovery mechanism for dashboards, saved searches, alerts, macros, event types, field extractions, lookups, and tags. The app periodically snapshots these objects into a dedicated summary index, preserving complete source code, authorship, and timestamps. When a knowledge object is accidentally deleted, overwritten, or moved, administrators can search the version history, compare changes through inline visual diffs, and optionally restore previous versions. The app includes custom visualizations for side-by-side source comparison and dashboard preview rendering. Restore functionality is opt-in and disabled by default, with one-click restore supported for dashboards and saved searches. All versioning and audit data persists independently in the ko_history index, ensuring recovery remains possible even after the original object has been removed from the system.