Splunk Enterprise Security

How can I see what Searches/Stories from "ES Content Update" App are viable in my environment?

woodcock
Esteemed Legend

I need something programatic to sort through the hundreds and hundreds of searches.

1 Solution

Noah_Woodcock
Path Finder

This does it nicely:

|rest/servicesNS/-/DA-ESS-ContentUpdate/saved/searches splunk_server=local
| search eai:acl.app="DA-ESS-ContentUpdate" OR request.ui_dispatch_app="DA-ESS-ContentUpdate"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title description cron_schedule allow_skew dispatch.earliest_time dispatch.latest_time alert_severity search
| rename dispatch.* AS *
| rename eai:acl.* AS *
| table owner sharing title search description*
| sort 0 title
| streamstats count AS Serial
| rex field=search max_match=0 "sourcetype[\s\r\n=\"]+(?<sourcetype>[^\)\r\n\s]+)"
| eval sourcetype=mvdedup(sourcetype)
| rex field=search max_match=0 "[\s\r\n]+datamodel[\s\r\n=\"]+(?<datamodel>[^\)\r\n\s\.]+)"
| eval datamodel=mvdedup(datamodel)
| eval which="DA-ESS-ContentUpdate"
| append [
|tstats count WHERE index=* earliest=-7d@d BY sourcetype
| search sourcetype!="*too_small"
| table sourcetype
| eval which="sourcetypes"]
| append [
|rest/servicesNS/-/Splunk_SA_CIM/data/models splunk_server=local
| search eai:acl.app="Splunk_SA_CIM"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title acceleration acceleration.backfill_time eai:data
| rename eai:acl.* AS * eai:data AS definition_JSON
| sort 0 title
| streamstats count AS Serial
| search acceleration=1
| table title
| rename title AS datamodel
| eval which="datamodels"]
| multireport
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY datamodel
| search whichCount>1 ]
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY sourcetype
| search whichCount>1 ]
| streamstats count AS Serial
| foreach * [ eval <<FIELD>> = mvdedup(<<FIELD>>) ]
| rename COMMENT AS "Remove what is below to see them as groups of searches; below splits it out as 1 search/event"
| eval tuple = mvzip(title, mvzip(search, description, ":::"), ":::")
| fields - title search description
| mvexpand tuple
| rex field=tuple "^(?<title>.+?):::(?<search>.+?):::(?<description>.+)$"
| fields - tuple
| rename Serial AS GroupMembership
| streamstats count AS Serial

View solution in original post

Noah_Woodcock
Path Finder

This does it nicely:

|rest/servicesNS/-/DA-ESS-ContentUpdate/saved/searches splunk_server=local
| search eai:acl.app="DA-ESS-ContentUpdate" OR request.ui_dispatch_app="DA-ESS-ContentUpdate"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title description cron_schedule allow_skew dispatch.earliest_time dispatch.latest_time alert_severity search
| rename dispatch.* AS *
| rename eai:acl.* AS *
| table owner sharing title search description*
| sort 0 title
| streamstats count AS Serial
| rex field=search max_match=0 "sourcetype[\s\r\n=\"]+(?<sourcetype>[^\)\r\n\s]+)"
| eval sourcetype=mvdedup(sourcetype)
| rex field=search max_match=0 "[\s\r\n]+datamodel[\s\r\n=\"]+(?<datamodel>[^\)\r\n\s\.]+)"
| eval datamodel=mvdedup(datamodel)
| eval which="DA-ESS-ContentUpdate"
| append [
|tstats count WHERE index=* earliest=-7d@d BY sourcetype
| search sourcetype!="*too_small"
| table sourcetype
| eval which="sourcetypes"]
| append [
|rest/servicesNS/-/Splunk_SA_CIM/data/models splunk_server=local
| search eai:acl.app="Splunk_SA_CIM"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title acceleration acceleration.backfill_time eai:data
| rename eai:acl.* AS * eai:data AS definition_JSON
| sort 0 title
| streamstats count AS Serial
| search acceleration=1
| table title
| rename title AS datamodel
| eval which="datamodels"]
| multireport
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY datamodel
| search whichCount>1 ]
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY sourcetype
| search whichCount>1 ]
| streamstats count AS Serial
| foreach * [ eval <<FIELD>> = mvdedup(<<FIELD>>) ]
| rename COMMENT AS "Remove what is below to see them as groups of searches; below splits it out as 1 search/event"
| eval tuple = mvzip(title, mvzip(search, description, ":::"), ":::")
| fields - title search description
| mvexpand tuple
| rex field=tuple "^(?<title>.+?):::(?<search>.+?):::(?<description>.+)$"
| fields - tuple
| rename Serial AS GroupMembership
| streamstats count AS Serial

woodcock
Esteemed Legend

That it does.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...