Knowledge Management

How can I see all tags in ES?

danielbb
Motivator

Going one by one through the tags and I can see the indexes which are tagged. So, we found the related indexes of authentication by running tag=authentication NOT (action=success user=*$).

So I wonder how can I find all the ES related tags? as tag=* gives no results...

Tags (2)
0 Karma
1 Solution

jawaharas
Motivator

Direct answer to this question is not a low-hanging fruit.

The list of datamodels used in ESS can be referred here - http://dev.splunk.com/view/enterprise-security/SP-CAAAFBM

And the 'tag' details corresponding to the each datamodel can be referred here (click on each datamodel to see tag details) - https://docs.splunk.com/Documentation/CIM/latest/User/Overview

View solution in original post

woodcock
Esteemed Legend

First of all, ES does not "use tags", it uses the CIM which does "use tags".
As far as investigating the CIM's use of tags and the data that you have in Splunk, the best tool that you can use is CIM Validator here:
https://github.com/hire-vladimir/SA-cim_vladiator

jawaharas
Motivator

Direct answer to this question is not a low-hanging fruit.

The list of datamodels used in ESS can be referred here - http://dev.splunk.com/view/enterprise-security/SP-CAAAFBM

And the 'tag' details corresponding to the each datamodel can be referred here (click on each datamodel to see tag details) - https://docs.splunk.com/Documentation/CIM/latest/User/Overview

View solution in original post

danielbb
Motivator

Nice, tag=authentication shows me the data but tag=web doesn't, even though we have web data.

index=* tag=web does work. So, why do we need in some case the index=* part? and in others it's not needed.

0 Karma

jawaharas
Motivator

Can you accept the answer if it's helpful?

0 Karma

danielbb
Motivator

Ok, the admin user doesn't have all the indexes in the default set of indexes ...

0 Karma

jawaharas
Motivator

You are right. For performance reasons it's not wiser to set 'Indexes searched by default' to search all indexes.

0 Karma