Knowledge Management

How can I see all tags in ES?

Motivator

Going one by one through the tags and I can see the indexes which are tagged. So, we found the related indexes of authentication by running tag=authentication NOT (action=success user=*$).

So I wonder how can I find all the ES related tags? as tag=* gives no results...

Tags (2)
0 Karma
1 Solution

Motivator

Direct answer to this question is not a low-hanging fruit.

The list of datamodels used in ESS can be referred here - http://dev.splunk.com/view/enterprise-security/SP-CAAAFBM

And the 'tag' details corresponding to the each datamodel can be referred here (click on each datamodel to see tag details) - https://docs.splunk.com/Documentation/CIM/latest/User/Overview

View solution in original post

Esteemed Legend

First of all, ES does not "use tags", it uses the CIM which does "use tags".
As far as investigating the CIM's use of tags and the data that you have in Splunk, the best tool that you can use is CIM Validator here:
https://github.com/hire-vladimir/SA-cim_vladiator

Motivator

Direct answer to this question is not a low-hanging fruit.

The list of datamodels used in ESS can be referred here - http://dev.splunk.com/view/enterprise-security/SP-CAAAFBM

And the 'tag' details corresponding to the each datamodel can be referred here (click on each datamodel to see tag details) - https://docs.splunk.com/Documentation/CIM/latest/User/Overview

View solution in original post

Motivator

Nice, tag=authentication shows me the data but tag=web doesn't, even though we have web data.

index=* tag=web does work. So, why do we need in some case the index=* part? and in others it's not needed.

0 Karma

Motivator

Can you accept the answer if it's helpful?

0 Karma

Motivator

Ok, the admin user doesn't have all the indexes in the default set of indexes ...

0 Karma

Motivator

You are right. For performance reasons it's not wiser to set 'Indexes searched by default' to search all indexes.

0 Karma