How can we track when Correlation searches were created

[LIP]

Hello

We have multiple people working on the content in Splunk Enterprise Security, and I need to be able to find when Correlation searches were created

What is the way to find it?

[marysan]

Hello

Im working with splunk version 7.2.3 and I suppose that this query can help you : (instead of author!= admin ypu can list your favorite authors)

| rest /services/saved/searches splunk_server=local count=0
| search author!="admin" AND action.correlationsearch.enabled=1
           | stats values(updated) as updated , values(action.correlationsearch.enabled) by title,author
           | sort - updated

[LIP]

Thanx, but this will give when the rule was updated and not when it was created.

[marysan]

Hello

I checked It
for new rules, it shows the date of creation 

[LIP]

yes, you're right. 
bUt, If user will edit the rules this date also will change and we will not be able to monitor old rule creation data (after user will update the rule)

[marysan]

OK. if you want to follow just creation, I have a best solution for you with lookup , to recognize new correlations :

1- first run this query just 1 time, to primitive lookup update: 
| rest /services/saved/searches splunk_server=local count=0
| search author!="admin" AND action.correlationsearch.enabled=1
           | table title,author
           | eval flag=1
           | outputlookup test2.csv

2-then make an alert or report and define a time schedule for that with this query to recognize new correlations created during alert/report time period (all titles that there is no flag=1 for them in lookup)  :
| rest /services/saved/searches splunk_server=local count=0
| search author!="admin" AND action.correlationsearch.enabled=1
            | table title,author
            | lookup test2.csv title as title output flag
            |search NOT flag=*
            | eval flag=1
            | outputlookup append=T test2.csv

as a result this query list for you just new correlations , for example if your time schedule is every day at 7 AM, it lists for you all correlation searches were create between yesterday 7 AM - today 7 AM

[LIP]

Thanks for this, but this table will be without "time" (only a list of rules names), and we will not be able to understand when the rules were created.

[richgalloway]

The Configuration Change Tracker feature in Splunk 9.0 will do that.  Just look for changes to savedsearches.conf.

Prior to Splunk 9.0, you'll have to process the access logs to find new CSs.

[13Noodles]

Do you have a specific example? I'm looking through the _configtracker index and not seeing any relevant info for savedsearches.conf changes.

[LIP]

Yes, I am using Splunk 8.X

What do I need to do in order to process the access logs to find new CSs?

[richgalloway]

So it looks like I overstated things a little.

Splunk 9.0 does indeed let you track changes to savedsearches.conf.  However, I can't find anything in the internal logs in 8.x that shows a new CS was created.  Sorry about that.