Splunk Enterprise Security

How to list data models and verify they are functioning properly?

Sven1
Path Finder

Thanks in advance for your time and assistance. 

Can someone please tell me how to generate a list of configured, properly functioning Data Models that support Splunk Enterprise Security correlation searches? 

There are more data models listed in Settings --> Data Models than when I perform a '| datamodel' search, such as the one pointed to here: list all datamodels with the feeds (index, sourcet... - Splunk Community.

I just want to nail down a method for ensuring that the data models configured within correlation searches are configured - AND are operating as intended. 

Again, thank you.

Sven

   

 

 

Labels (1)
0 Karma
1 Solution

meetmshah
Contributor

Hello @Sven1, To list down all the correlation searches from all Data Models, can you please try below search - 

| rest /servicesNS/-/-/saved/searches splunk_server=local 
| where disabled=0
| search search="*datamodel*" 
| rex field=search max_match=0 "from\ datamodel(\ |\=\"|\=|\:\"|\=)(?P<datamodel_Name>[a-zA-Z0-9\_]+)" 
| table datamodel_Name, title, qualifiedSearch, search, updated, "eai:acl.owner", author, "eai:aal.app" 
| mvexpand datamodel_Name 
| stats values(title) by datamodel_Name
| fields - count

 

Above search will give you near-accurate results.

 

Please accept the solution if this helps!

View solution in original post

meetmshah
Contributor

Hello @Sven1, To list down all the correlation searches from all Data Models, can you please try below search - 

| rest /servicesNS/-/-/saved/searches splunk_server=local 
| where disabled=0
| search search="*datamodel*" 
| rex field=search max_match=0 "from\ datamodel(\ |\=\"|\=|\:\"|\=)(?P<datamodel_Name>[a-zA-Z0-9\_]+)" 
| table datamodel_Name, title, qualifiedSearch, search, updated, "eai:acl.owner", author, "eai:aal.app" 
| mvexpand datamodel_Name 
| stats values(title) by datamodel_Name
| fields - count

 

Above search will give you near-accurate results.

 

Please accept the solution if this helps!

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...