Splunk Searches | A collection of useful Splunk SPL

Splunk Search for Last Time a Correlation Search Was Updated Copy


				| rest splunk_server=local /servicesNS/-/-/saved/searches | where match('action.correlationsearch.enabled',"1|(?i)true") | table title search updated

0 comments

[0]

Splunk Search for Datamodels Used by Enterprise Security Correlation Searches Copy


				| rest splunk_server=local /services/saved/searches | where match(search,"datamodel") and 'action.correlationsearch.enabled'=1 | fields title search | rex field=search "datamodel=(?<datamodel1\S+)" | rex field=search "datamodel:(?<datamodel2>\S+)" | rex field=search "datamodel\s\"(?<datamodel3>[^\"]+)" | eval datamodel=coalesce(datamodel1,coalesce(datamodel2,datamodel3)) | table title search datamodel

0 comments

[0]