HI,
I am trying to create a dashboard which is similar to incident review dashboard, I am looking for users to be able to select time and detection name to display notables per time/rule but also show only fields extracted on CR on | fields command.
I was able to accomplish part of it by merging index notable with rest api command and then extracting with regex information after | fields in the spl. Which gave me a list of fields available such as
title: Brute Force
field_values: _time, created_at, ip, md5, attempts...
I need that list of fields within field_values to be shown as actual fields whenever the user selects and specific detection. This will need to be dynamic because there are different fields which will change per detection.
Search:
index=notable
| rename search_name as title
| search title="*"
| join type=left title
[ | rest /servicesNS/-/-/saved/searches splunk_server=local
| eval disabled=if(disabled=1,"true","false")
| search disabled=false actions IN ("*notable*")
| rex field=search "\|\s*(fields|table)\s+(?<field_values>.*)"
| fields title field_values]
I appreciate any help since I have been scratching my head for a couple of weeks now.
Thanks in advance.
