I need a query to get the new created use cases for the last 7 days

[yazeed]

I need a query to get the new created use cases in the last 7 days and another query to get the fine tuned use cases for the last 7 days.

[kiran_panchavat]

@yazeed 

Splunk's _configtracker can be used to monitor changes to alerts and saved searches in Splunk.

The _configtracker index:

With Splunk 9, the _configtracker index was introduced. This index stores changes to Splunk configuration files, including the date and time of the change, as well as all the new and old values associated with the modified item.

However, the data in _configtracker has a limitation: it only monitors changes to configuration files. Consequently, a crucial piece of information is missing from these logs: the user responsible for the change. While it does provide a record of the previous and updated settings, this information is not available in the same event. Therefore, to create a comprehensive alert, we need to perform data aggregation and enrichment.

For instance, after the described change to the Windows failed logons alert use case, the configtracker will contain two related events. Note the search looks in the _configtracker index, for a configuration update, where the changed item (data.changes{}.stanza) is specified, and particularly for a saved search being changed, independently of the app and Splunk installation directory ("*/savedsearches.conf").

Here is the SPL query:

index=_configtracker component=ConfigChange data.action=update data.changes{}.stanza=* data.path="*/savedsearches.conf"

[richgalloway]

What exactly do you mean by "new created use cases" and "fine tuned use cases"?  What queries have you tried?  How did those queries not meet expectations?

[yazeed]

Is there any possible queries to get the list of new created use case from ES and the fine tuned use cases and the non triggered use cases for the last 7 days.

I have searched over internet but unfortunately did not found as I have found only the list of enabled disabled and triggered use cases.

[richgalloway]

Repeating the OP does not answer my questions. 

Please use different words to explain what you are looking for.

Perhaps the _configtracker index has the information you seek.