Suggestions for Splunk Search/Report

[Hugh.Kelley]

I have several Splunk searches that I use as indicator lists.  Has someone already built a miner/prototype to retrieve these?

The generic API examples don't seem sufficient for Splunk's two-step routine (search then retrieve results).

https://docs.splunk.com/Documentation/Splunk/latest/Search/ExportdatausingRESTAPI 

[Hugh.Kelley]

I didn't find anything so I built an extension.

https://github.com/hkelley/splunksearch-miner

[Joel_Fostano]

Thank you @Hugh.Kelley for creating this Miner. I'm in a similar situation on trying to ingest a saved search from our Cloud Splunk instance that we are using as a "known" blocklist which is being curated by our SOC. I'm running into a little bit of a challenge when running hte miner. It appears to fun successfully but does not seem to be pulling back any indicators. In looking at the miner configuration I didn't see a place for the "saved_serach" entry and added a variable to the configuration called saved_search. Was wondering if you would be able to provide any insight as to what I may be doing incorrectly.
age_out:
default: 7d
interval: 600
sudden_death: true
attributes:
confidence: 60
share_level: green
type: IPv4
extractor: results
fields: entity
password: <password>
prefix: None
search_name: <search_name>
url: https://<host>.splunkcloud.com:8089/services/search/jobs 
username: <username>
verify_cert: false

also tried with "https://xxx.splunkcloud.com:8089/servicesNS/nobody/<APP_NAME>/search/jobs/"

[Hugh.Kelley]

@Joel_Fostano ,  it has been a few years so I've forgotten the details,  but my prototype looks like yours:

It pulls the search_name setting the same way it gets the time settings (line 21 at URL below)

splunksearchminer/node.py 

If you look in the _internal index of Splunk, do you see any evidence of a search?