topic Re: How to know all the Contents created from a specific data model in Splunk Enterprise Security ? in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-know-all-the-Contents-created-from-a-specific-data-model/m-p/571491#M10390 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/237518">@zacksoft_wf</a>&nbsp; If you already know your sourcetypes, try follow this post - this may help you to get the relevant KOs : <A href="https://community.splunk.com/t5/Security/Sourcetypes-list-of-where-they-re-being-used/m-p/306682" target="_blank">https://community.splunk.com/t5/Security/Sourcetypes-list-of-where-they-re-being-used/m-p/306682</A></P><P>Keen to know how you go with this.&nbsp;</P> Tue, 19 Oct 2021 10:15:51 GMT dwickram 2021-10-19T10:15:51Z How to know all the Contents created from a specific data model in Splunk Enterprise Security ? https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-know-all-the-Contents-created-from-a-specific-data-model/m-p/571278#M10383 <P>I want to list all the 'Authentication' related content we have created in the ES App.<BR />Is there any SPL query to get this.<BR />Need to list all the dashboards, Notable Events etc... of Authentication type.<BR />I would really appreciate any help.<BR /><BR /><BR /></P> Mon, 18 Oct 2021 08:24:19 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-know-all-the-Contents-created-from-a-specific-data-model/m-p/571278#M10383 zacksoft_wf 2021-10-18T08:24:19Z Re: How to know all the Contents created from a specific data model in Splunk Enterprise Security ? https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-know-all-the-Contents-created-from-a-specific-data-model/m-p/571332#M10384 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/237518">@zacksoft_wf</a>&nbsp; Hi there, not sure if just one SPL can give all the stats you're after, but if you navigate to Configure --&gt; Content Management --&gt;&nbsp; And on Search window type "Authentication", this gives a list of items configured under Authentication. Did you try this already OR you need still need a SPL to query a statistical view?&nbsp;</P> Mon, 18 Oct 2021 13:10:08 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-know-all-the-Contents-created-from-a-specific-data-model/m-p/571332#M10384 dwickram 2021-10-18T13:10:08Z Re: How to know all the Contents created from a specific data model in Splunk Enterprise Security ? https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-know-all-the-Contents-created-from-a-specific-data-model/m-p/571337#M10385 <P>I was thinking , if I have my sourcetypes names with me, Can we build a query that can scan _internal log or something and tell me in which contents (dashboard, Correlation Searches etc, ) this sourcetype is used . That could help too.</P> Mon, 18 Oct 2021 13:35:06 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-know-all-the-Contents-created-from-a-specific-data-model/m-p/571337#M10385 zacksoft_wf 2021-10-18T13:35:06Z Re: How to know all the Contents created from a specific data model in Splunk Enterprise Security ? https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-know-all-the-Contents-created-from-a-specific-data-model/m-p/571357#M10386 <P>I don't think so. Remember that you can reference objects using macros so even if you listed all configuration and user content and searched through it for your data model, you wouldn't find occurences of macros defined with that datamodel. And that could possibly involve another macro. And so on.</P><P>So there can be some approximate methods but I don't see a 100% reliable way.</P> Mon, 18 Oct 2021 15:04:03 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-know-all-the-Contents-created-from-a-specific-data-model/m-p/571357#M10386 PickleRick 2021-10-18T15:04:03Z Re: How to know all the Contents created from a specific data model in Splunk Enterprise Security ? https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-know-all-the-Contents-created-from-a-specific-data-model/m-p/571472#M10388 <P>SPL query with statistical view would be helpful.</P> Tue, 19 Oct 2021 07:26:56 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-know-all-the-Contents-created-from-a-specific-data-model/m-p/571472#M10388 zacksoft_wf 2021-10-19T07:26:56Z Re: How to know all the Contents created from a specific data model in Splunk Enterprise Security ? https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-know-all-the-Contents-created-from-a-specific-data-model/m-p/571473#M10389 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/231884">@PickleRick</a>&nbsp; &nbsp;hmm.. That makes sense. thanks for the input.</P> Tue, 19 Oct 2021 07:28:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-know-all-the-Contents-created-from-a-specific-data-model/m-p/571473#M10389 zacksoft_wf 2021-10-19T07:28:42Z Re: How to know all the Contents created from a specific data model in Splunk Enterprise Security ? https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-know-all-the-Contents-created-from-a-specific-data-model/m-p/571491#M10390 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/237518">@zacksoft_wf</a>&nbsp; If you already know your sourcetypes, try follow this post - this may help you to get the relevant KOs : <A href="https://community.splunk.com/t5/Security/Sourcetypes-list-of-where-they-re-being-used/m-p/306682" target="_blank">https://community.splunk.com/t5/Security/Sourcetypes-list-of-where-they-re-being-used/m-p/306682</A></P><P>Keen to know how you go with this.&nbsp;</P> Tue, 19 Oct 2021 10:15:51 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-know-all-the-Contents-created-from-a-specific-data-model/m-p/571491#M10390 dwickram 2021-10-19T10:15:51Z