Splunk Enterprise

Need help with preparing a list of Middleware reports on the Ent. + write an alert to be notified when they are changed.

SamHTexas
Builder

I need help with writing an SPL to list all the Middleware reports on the Splunk Ent. & An alert to email me when any report is changed please. Thank very much.

Labels (1)
Tags (1)
0 Karma

SinghK
Builder

All reports are saved searches 

|rest /servicesNS/-/-/saved/searches|table title, updated 

 

the spl query above will give you all the searches on your splunk instance and when they are updated. you will need to filter out your searches and setup and alert.

you can also add field "author" this way it will let you catch the person who changed it. 

inventsekar
SplunkTrust
SplunkTrust

Hi @SamHTexas .. we will need more details from your side..

 list all the Middleware reports  are they created by a same person / same app / same team? we got some rest api's that will list down all reports..

 

Once we created the SPL query to list down all middleware reports, its easy to create email alert. 

hope you got the idea, thanks. 

0 Karma

SamHTexas
Builder

Would you please share an SPL that would make a list of the only the middleware reports. Thanks a million

Tags (1)
0 Karma

SamHTexas
Builder

Thank u very much for your reply. Would you share a SPL I can use in GUI for all & one for 2 Teams that create the middleware reports. I really appreciate your help. Thx

Tags (1)
0 Karma

SinghK
Builder

Sam, 

 

this is the query

|rest /servicesNS/-/-/saved/searches|table title, updated, author. run that in search and you will get results.

SamHTexas
Builder

Thanks very much. Would this work on the Splunk Ent. as well as the ES? 

Tags (1)
0 Karma

SinghK
Builder

Yes.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...