Splunk Enterprise Security

How can I see what Searches/Stories from "ES Content Update" App are viable in my environment?

woodcock
Esteemed Legend

I need something programatic to sort through the hundreds and hundreds of searches.

1 Solution

Noah_Woodcock
Path Finder

This does it nicely:

|rest/servicesNS/-/DA-ESS-ContentUpdate/saved/searches splunk_server=local
| search eai:acl.app="DA-ESS-ContentUpdate" OR request.ui_dispatch_app="DA-ESS-ContentUpdate"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title description cron_schedule allow_skew dispatch.earliest_time dispatch.latest_time alert_severity search
| rename dispatch.* AS *
| rename eai:acl.* AS *
| table owner sharing title search description*
| sort 0 title
| streamstats count AS Serial
| rex field=search max_match=0 "sourcetype[\s\r\n=\"]+(?<sourcetype>[^\)\r\n\s]+)"
| eval sourcetype=mvdedup(sourcetype)
| rex field=search max_match=0 "[\s\r\n]+datamodel[\s\r\n=\"]+(?<datamodel>[^\)\r\n\s\.]+)"
| eval datamodel=mvdedup(datamodel)
| eval which="DA-ESS-ContentUpdate"
| append [
|tstats count WHERE index=* earliest=-7d@d BY sourcetype
| search sourcetype!="*too_small"
| table sourcetype
| eval which="sourcetypes"]
| append [
|rest/servicesNS/-/Splunk_SA_CIM/data/models splunk_server=local
| search eai:acl.app="Splunk_SA_CIM"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title acceleration acceleration.backfill_time eai:data
| rename eai:acl.* AS * eai:data AS definition_JSON
| sort 0 title
| streamstats count AS Serial
| search acceleration=1
| table title
| rename title AS datamodel
| eval which="datamodels"]
| multireport
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY datamodel
| search whichCount>1 ]
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY sourcetype
| search whichCount>1 ]
| streamstats count AS Serial
| foreach * [ eval <<FIELD>> = mvdedup(<<FIELD>>) ]
| rename COMMENT AS "Remove what is below to see them as groups of searches; below splits it out as 1 search/event"
| eval tuple = mvzip(title, mvzip(search, description, ":::"), ":::")
| fields - title search description
| mvexpand tuple
| rex field=tuple "^(?<title>.+?):::(?<search>.+?):::(?<description>.+)$"
| fields - tuple
| rename Serial AS GroupMembership
| streamstats count AS Serial

View solution in original post

Noah_Woodcock
Path Finder

This does it nicely:

|rest/servicesNS/-/DA-ESS-ContentUpdate/saved/searches splunk_server=local
| search eai:acl.app="DA-ESS-ContentUpdate" OR request.ui_dispatch_app="DA-ESS-ContentUpdate"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title description cron_schedule allow_skew dispatch.earliest_time dispatch.latest_time alert_severity search
| rename dispatch.* AS *
| rename eai:acl.* AS *
| table owner sharing title search description*
| sort 0 title
| streamstats count AS Serial
| rex field=search max_match=0 "sourcetype[\s\r\n=\"]+(?<sourcetype>[^\)\r\n\s]+)"
| eval sourcetype=mvdedup(sourcetype)
| rex field=search max_match=0 "[\s\r\n]+datamodel[\s\r\n=\"]+(?<datamodel>[^\)\r\n\s\.]+)"
| eval datamodel=mvdedup(datamodel)
| eval which="DA-ESS-ContentUpdate"
| append [
|tstats count WHERE index=* earliest=-7d@d BY sourcetype
| search sourcetype!="*too_small"
| table sourcetype
| eval which="sourcetypes"]
| append [
|rest/servicesNS/-/Splunk_SA_CIM/data/models splunk_server=local
| search eai:acl.app="Splunk_SA_CIM"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title acceleration acceleration.backfill_time eai:data
| rename eai:acl.* AS * eai:data AS definition_JSON
| sort 0 title
| streamstats count AS Serial
| search acceleration=1
| table title
| rename title AS datamodel
| eval which="datamodels"]
| multireport
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY datamodel
| search whichCount>1 ]
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY sourcetype
| search whichCount>1 ]
| streamstats count AS Serial
| foreach * [ eval <<FIELD>> = mvdedup(<<FIELD>>) ]
| rename COMMENT AS "Remove what is below to see them as groups of searches; below splits it out as 1 search/event"
| eval tuple = mvzip(title, mvzip(search, description, ":::"), ":::")
| fields - title search description
| mvexpand tuple
| rex field=tuple "^(?<title>.+?):::(?<search>.+?):::(?<description>.+)$"
| fields - tuple
| rename Serial AS GroupMembership
| streamstats count AS Serial

woodcock
Esteemed Legend

That it does.

0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...