Config change fields

The changed object, its type, the action performed and how the change is known.

Field	Type	Unit	Meaning
sparklogs.config_change.type	string		The kind of configuration object that changed.
sparklogs.config_change.target	string		The object's identity within its type, such as a name, path, or id.
sparklogs.config_change.target_name	string		The object's name for a reader at the time of the change, display only and never an identity; absent when the record carries no human name or only an unresolved indirect string.
sparklogs.config_change.action	string		The action applied to the configuration object.
sparklogs.config_change.basis	string		How the change is known, recorded when an OS or app log recorded it, observed when the agent saw the end state move between two captures.
sparklogs.config_change.category	string		Positive upkeep classification, maintenance when established, omitted otherwise.
sparklogs.config_change.changes	object_array		One entry per moved field, with field, and old and new as the row carries them. A side the row did not carry is absent.
sparklogs.config_change.changes[].field	string		In each changes entry.
sparklogs.config_change.changes[].old	any		In each changes entry.
sparklogs.config_change.changes[].new	any		In each changes entry.
sparklogs.config_change.renamed_from	string		On an update of a subject that changed identity (a driver package renumbered by its update, or a program whose name carries its version), the instance of the subject it replaced. Absent otherwise.
sparklogs.config_change.recorded_evidence	object_array		Exact selectors for the recorded events behind a change. On an observed service installation or driver load, an independent record of the same change, association: inferred_same_change. On a change with basis: recorded, the record the change was read from, association: source_record. Each entry has original UTC RFC3339 t, match_fields (subsource, origin, event_id, positive signed record_id) and association. A referenced original may be unavailable in stored events.
sparklogs.config_change.recorded_evidence[].t	string	timestamp	In each recorded_evidence entry.
sparklogs.config_change.recorded_evidence[].match_fields	object		In each recorded_evidence entry.
sparklogs.config_change.recorded_evidence[].association	string		In each recorded_evidence entry.
sparklogs.config_change.recorded_evidence_truncated	bool		True when valid recorded-event selectors exceeded the four-object or 16 KiB attachment limit. Absent otherwise.