topic Re: Suggestions for Splunk Search/Report in General Topics

Suggestions for Splunk Search/Report

Hugh.Kelley — Sun, 23 Dec 2018 14:37:43 GMT

I have several Splunk searches that I use as indicator lists. Has someone already built a miner/prototype to retrieve these?

The generic API examples don't seem sufficient for Splunk's two-step routine (search then retrieve results).

https://docs.splunk.com/Documentation/Splunk/latest/Search/ExportdatausingRESTAPI

Re: Suggestions for Splunk Search/Report

Hugh.Kelley — Tue, 25 Dec 2018 20:55:27 GMT

I didn't find anything so I built an extension.

https://github.com/hkelley/splunksearch-miner

Re: Suggestions for Splunk Search/Report

Joel_Fostano — Mon, 11 Jul 2022 21:12:36 GMT

Thank you @Hugh.Kelley for creating this Miner. I'm in a similar situation on trying to ingest a saved search from our Cloud Splunk instance that we are using as a "known" blocklist which is being curated by our SOC. I'm running into a little bit of a challenge when running hte miner. It appears to fun successfully but does not seem to be pulling back any indicators. In looking at the miner configuration I didn't see a place for the "saved_serach" entry and added a variable to the configuration called saved_search. Was wondering if you would be able to provide any insight as to what I may be doing incorrectly.
age_out:
default: 7d
interval: 600
sudden_death: true
attributes:
confidence: 60
share_level: green
type: IPv4
extractor: results
fields: entity
password: <password>
prefix: None
search_name: <search_name>
url: https://<host>.splunkcloud.com:8089/services/search/jobs
username: <username>
verify_cert: false

also tried with "https://xxx.splunkcloud.com:8089/servicesNS/nobody/<APP_NAME>/search/jobs/"

Re: Suggestions for Splunk Search/Report

Hugh.Kelley — Fri, 15 Jul 2022 01:18:26 GMT

@Joel_Fostano , it has been a few years so I've forgotten the details, but my prototype looks like yours:

It pulls the search_name setting the same way it gets the time settings (line 21 at URL below)

splunksearchminer/node.py

If you look in the _internal index of Splunk, do you see any evidence of a search?