How to know all the Contents created from a specific data model in Splunk Enterprise Security ?

[zacksoft_wf]

I want to list all the 'Authentication' related content we have created in the ES App.
Is there any SPL query to get this.
Need to list all the dashboards, Notable Events etc... of Authentication type.
I would really appreciate any help.

[PickleRick]

I don't think so. Remember that you can reference objects using macros so even if you listed all configuration and user content and searched through it for your data model, you wouldn't find occurences of macros defined with that datamodel. And that could possibly involve another macro. And so on.

So there can be some approximate methods but I don't see a 100% reliable way.

[zacksoft_wf]

@PickleRick   hmm.. That makes sense. thanks for the input.

[dwickram]

@zacksoft_wf  Hi there, not sure if just one SPL can give all the stats you're after, but if you navigate to Configure --> Content Management -->  And on Search window type "Authentication", this gives a list of items configured under Authentication. Did you try this already OR you need still need a SPL to query a statistical view? 

[zacksoft_wf]

SPL query with statistical view would be helpful.

[zacksoft_wf]

I was thinking , if I have my sourcetypes names with me, Can we build a query that can scan _internal log or something and tell me in which contents (dashboard, Correlation Searches etc, ) this sourcetype is used . That could help too.

[dwickram · Accepted solution]

@zacksoft_wf  If you already know your sourcetypes, try follow this post - this may help you to get the relevant KOs : https://community.splunk.com/t5/Security/Sourcetypes-list-of-where-they-re-being-used/m-p/306682

Keen to know how you go with this.