Splunk Enterprise Security

How to list data models and verify they are functioning properly?

Sven1
Path Finder

Thanks in advance for your time and assistance. 

Can someone please tell me how to generate a list of configured, properly functioning Data Models that support Splunk Enterprise Security correlation searches? 

There are more data models listed in Settings --> Data Models than when I perform a '| datamodel' search, such as the one pointed to here: list all datamodels with the feeds (index, sourcet... - Splunk Community.

I just want to nail down a method for ensuring that the data models configured within correlation searches are configured - AND are operating as intended. 

Again, thank you.

Sven

   

 

 

Labels (1)
0 Karma
1 Solution

meetmshah
Contributor

Hello @Sven1, To list down all the correlation searches from all Data Models, can you please try below search - 

| rest /servicesNS/-/-/saved/searches splunk_server=local 
| where disabled=0
| search search="*datamodel*" 
| rex field=search max_match=0 "from\ datamodel(\ |\=\"|\=|\:\"|\=)(?P<datamodel_Name>[a-zA-Z0-9\_]+)" 
| table datamodel_Name, title, qualifiedSearch, search, updated, "eai:acl.owner", author, "eai:aal.app" 
| mvexpand datamodel_Name 
| stats values(title) by datamodel_Name
| fields - count

 

Above search will give you near-accurate results.

 

Please accept the solution if this helps!

View solution in original post

meetmshah
Contributor

Hello @Sven1, To list down all the correlation searches from all Data Models, can you please try below search - 

| rest /servicesNS/-/-/saved/searches splunk_server=local 
| where disabled=0
| search search="*datamodel*" 
| rex field=search max_match=0 "from\ datamodel(\ |\=\"|\=|\:\"|\=)(?P<datamodel_Name>[a-zA-Z0-9\_]+)" 
| table datamodel_Name, title, qualifiedSearch, search, updated, "eai:acl.owner", author, "eai:aal.app" 
| mvexpand datamodel_Name 
| stats values(title) by datamodel_Name
| fields - count

 

Above search will give you near-accurate results.

 

Please accept the solution if this helps!

Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...