Splunk Enterprise Security

How to list data models and verify they are functioning properly?

Sven1
Path Finder

Thanks in advance for your time and assistance. 

Can someone please tell me how to generate a list of configured, properly functioning Data Models that support Splunk Enterprise Security correlation searches? 

There are more data models listed in Settings --> Data Models than when I perform a '| datamodel' search, such as the one pointed to here: list all datamodels with the feeds (index, sourcet... - Splunk Community.

I just want to nail down a method for ensuring that the data models configured within correlation searches are configured - AND are operating as intended. 

Again, thank you.

Sven

   

 

 

Labels (1)
0 Karma
1 Solution

meetmshah
Builder

Hello @Sven1, To list down all the correlation searches from all Data Models, can you please try below search - 

| rest /servicesNS/-/-/saved/searches splunk_server=local 
| where disabled=0
| search search="*datamodel*" 
| rex field=search max_match=0 "from\ datamodel(\ |\=\"|\=|\:\"|\=)(?P<datamodel_Name>[a-zA-Z0-9\_]+)" 
| table datamodel_Name, title, qualifiedSearch, search, updated, "eai:acl.owner", author, "eai:aal.app" 
| mvexpand datamodel_Name 
| stats values(title) by datamodel_Name
| fields - count

 

Above search will give you near-accurate results.

 

Please accept the solution if this helps!

View solution in original post

meetmshah
Builder

Hello @Sven1, To list down all the correlation searches from all Data Models, can you please try below search - 

| rest /servicesNS/-/-/saved/searches splunk_server=local 
| where disabled=0
| search search="*datamodel*" 
| rex field=search max_match=0 "from\ datamodel(\ |\=\"|\=|\:\"|\=)(?P<datamodel_Name>[a-zA-Z0-9\_]+)" 
| table datamodel_Name, title, qualifiedSearch, search, updated, "eai:acl.owner", author, "eai:aal.app" 
| mvexpand datamodel_Name 
| stats values(title) by datamodel_Name
| fields - count

 

Above search will give you near-accurate results.

 

Please accept the solution if this helps!

Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...