List of Disabled / Enabled Correlation Searches in last 7 days

[SushmaK]

How can I get a list of disabled or enabled correlation searches in last 7 days?

As of now, I have a query to fetch the full list of all the correlation searches with disabled and enabled status. But I'm unable to fetch the correlation search list which are enabled or disabled in last 7 days.

Please help me out.

[SushmaK]

Hi @richgalloway 

Thanks for the reply!

Currently I'm using the below query to fetch the full list of Correlation search:-

| rest splunk_server=local count=0 /services/saved/searches
| where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]")
| rename action.correlationsearch.label as Alert_Name,action.correlationsearch.annotations as frameworks,updated as Last_Updated
| table Alert_Name, frameworks, disabled, Last_Updated
| spath input=frameworks
| table Alert_Name,disabled,Last_Updated

The place where I'm facing the difficulty is, I'm unable to search the disabled or enabled CS in a particular time(for ex: 7days). Need help on this.

[richgalloway]

As I stated in my first reply (perhaps not so well), the REST commands only report the *current* state, not past states. To know what changed in the past 7 days, you have to save the CS list today then wait 7 days and get a new list.  The difference is what changed.

[richgalloway]

We only can fetch the current list of CSs.  To know which have been disabled recently, you'll have to keep a list of them (in a lookup, for example) and compare the current list to the saved list.

You may be able to examine the configtracker logs to see which searches have been disabled recently.  This should get you started by providing a list of newly-disabled saved searches.  I'll leave it to you to figure out which are correlation searches and which are normal searches.

index=_configtracker "data.changes{}.properties{}.name"="disabled" ("data.changes{}.properties{}.old_value"="*" OR "data.changes{}.properties{}.old_value"="false") ("data.changes{}.properties{}.new_value"="1" OR "data.changes{}.properties{}.new_value"="true") "data.changes{}.stanza"!="feature:*" "data.path"="*savedsearches.conf"