Splunk SOAR - Delete Almost unused Label?

[curtisjester]

Hey there,

Let me start off by saying I can delete labels if there are no assets using them. The issue originates when an asset is "using" these labels but I cannot tell how.

For some reason we have "event" and "events" where I would like to delete the unused "event" label. But there's an asset using it. Looking under all configured assets I cannot find where the label "event" is used.

How can I accomplish my goal of finding the asset that is listed, when it's only a simple description:
1 Asset (asset name)

When looking at all my assets, only one matches. But inside this asset for the app Rest API, I can't find any mention or designation for labels whatsoever.

The asset

[marnall · Accepted solution]

There must be a tab in Asset Configuration called "Ingest Settings", in the middle between Asset Settings and Approval Settings. In that area you can specify the label to apply to created objects from the app.

Since this is missing in your "splunk" asset, something is broken. You might need to delete the asset and re-create it to get it to let go of the label.

[curtisjester]

That worked; not sure why that was the case -- I will note you weren't correct in regards to "Ingest settings" but for some reason the asset defaulted to the Event label instead of "events" and this connection, once severed, updated my labels and removed Event