Splunk Enterprise Security

Create investigation in ES using SPL outputlookup command?

samlinsongguo
Communicator

Hi Everyone 

I am trying to create an investigation in ES using SPL.

Since ES is most work as lookup/kvstore, so I try to run the following SPL

| makeresults
| eval class_name="investigation",
    collaborators="[{\"name\": \"AAAAAA\", \"write\": true}, {\"name\": \"BBBBBB\", \"write\": true}]",
    create_time=1668731443,
    creator="CCCCCC",
    description="DDDDDDD",
    mod_time=1668731608,
    status="[{\"name\": \"In Progress\", \"time\": 1668739809, \"id\": \"investigation:2\"}]",
    title="EEEEEEE",
    version=1,
    comments="[]",
    tags="[]"
| table class_name, collaborators, create_time, creator, description, mod_time, status, title, version, comments, tags | outputlookup append=true investigation

I am able to add an entry in the KV store, but when I load the investigation tab in ES is breaks and appear Error as "Expect an array" and not able to load the page
 
Has anyone done this before?
 
Is that the right way, or is there another way to use SPL to create an investigation? 
 
 
 
 
 
Labels (2)
0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...