Splunk Enterprise Security

How can I see what Searches/Stories from "ES Content Update" App are viable in my environment?

woodcock
Esteemed Legend

I need something programatic to sort through the hundreds and hundreds of searches.

1 Solution

Noah_Woodcock
Path Finder

This does it nicely:

|rest/servicesNS/-/DA-ESS-ContentUpdate/saved/searches splunk_server=local
| search eai:acl.app="DA-ESS-ContentUpdate" OR request.ui_dispatch_app="DA-ESS-ContentUpdate"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title description cron_schedule allow_skew dispatch.earliest_time dispatch.latest_time alert_severity search
| rename dispatch.* AS *
| rename eai:acl.* AS *
| table owner sharing title search description*
| sort 0 title
| streamstats count AS Serial
| rex field=search max_match=0 "sourcetype[\s\r\n=\"]+(?<sourcetype>[^\)\r\n\s]+)"
| eval sourcetype=mvdedup(sourcetype)
| rex field=search max_match=0 "[\s\r\n]+datamodel[\s\r\n=\"]+(?<datamodel>[^\)\r\n\s\.]+)"
| eval datamodel=mvdedup(datamodel)
| eval which="DA-ESS-ContentUpdate"
| append [
|tstats count WHERE index=* earliest=-7d@d BY sourcetype
| search sourcetype!="*too_small"
| table sourcetype
| eval which="sourcetypes"]
| append [
|rest/servicesNS/-/Splunk_SA_CIM/data/models splunk_server=local
| search eai:acl.app="Splunk_SA_CIM"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title acceleration acceleration.backfill_time eai:data
| rename eai:acl.* AS * eai:data AS definition_JSON
| sort 0 title
| streamstats count AS Serial
| search acceleration=1
| table title
| rename title AS datamodel
| eval which="datamodels"]
| multireport
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY datamodel
| search whichCount>1 ]
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY sourcetype
| search whichCount>1 ]
| streamstats count AS Serial
| foreach * [ eval <<FIELD>> = mvdedup(<<FIELD>>) ]
| rename COMMENT AS "Remove what is below to see them as groups of searches; below splits it out as 1 search/event"
| eval tuple = mvzip(title, mvzip(search, description, ":::"), ":::")
| fields - title search description
| mvexpand tuple
| rex field=tuple "^(?<title>.+?):::(?<search>.+?):::(?<description>.+)$"
| fields - tuple
| rename Serial AS GroupMembership
| streamstats count AS Serial

View solution in original post

Noah_Woodcock
Path Finder

This does it nicely:

|rest/servicesNS/-/DA-ESS-ContentUpdate/saved/searches splunk_server=local
| search eai:acl.app="DA-ESS-ContentUpdate" OR request.ui_dispatch_app="DA-ESS-ContentUpdate"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title description cron_schedule allow_skew dispatch.earliest_time dispatch.latest_time alert_severity search
| rename dispatch.* AS *
| rename eai:acl.* AS *
| table owner sharing title search description*
| sort 0 title
| streamstats count AS Serial
| rex field=search max_match=0 "sourcetype[\s\r\n=\"]+(?<sourcetype>[^\)\r\n\s]+)"
| eval sourcetype=mvdedup(sourcetype)
| rex field=search max_match=0 "[\s\r\n]+datamodel[\s\r\n=\"]+(?<datamodel>[^\)\r\n\s\.]+)"
| eval datamodel=mvdedup(datamodel)
| eval which="DA-ESS-ContentUpdate"
| append [
|tstats count WHERE index=* earliest=-7d@d BY sourcetype
| search sourcetype!="*too_small"
| table sourcetype
| eval which="sourcetypes"]
| append [
|rest/servicesNS/-/Splunk_SA_CIM/data/models splunk_server=local
| search eai:acl.app="Splunk_SA_CIM"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title acceleration acceleration.backfill_time eai:data
| rename eai:acl.* AS * eai:data AS definition_JSON
| sort 0 title
| streamstats count AS Serial
| search acceleration=1
| table title
| rename title AS datamodel
| eval which="datamodels"]
| multireport
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY datamodel
| search whichCount>1 ]
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY sourcetype
| search whichCount>1 ]
| streamstats count AS Serial
| foreach * [ eval <<FIELD>> = mvdedup(<<FIELD>>) ]
| rename COMMENT AS "Remove what is below to see them as groups of searches; below splits it out as 1 search/event"
| eval tuple = mvzip(title, mvzip(search, description, ":::"), ":::")
| fields - title search description
| mvexpand tuple
| rex field=tuple "^(?<title>.+?):::(?<search>.+?):::(?<description>.+)$"
| fields - tuple
| rename Serial AS GroupMembership
| streamstats count AS Serial

woodcock
Esteemed Legend

That it does.

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...