Suggestions for Splunk Search/Report

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Suggestions for Splunk Search/Report

L2 Linker

I have several Splunk searches that I use as indicator lists.  Has someone already built a miner/prototype to retrieve these?

 

The generic API examples don't seem sufficient for Splunk's two-step routine (search then retrieve results).

 

https://docs.splunk.com/Documentation/Splunk/latest/Search/ExportdatausingRESTAPI 

3 REPLIES 3

L2 Linker

I didn't find anything so I built an extension.

 

https://github.com/hkelley/splunksearch-miner

Thank you @Hugh.Kelley for creating this Miner. I'm in a similar situation on trying to ingest a saved search from our Cloud Splunk instance that we are using as a "known" blocklist which is being curated by our SOC. I'm running into a little bit of a challenge when running hte miner. It appears to fun successfully but does not seem to be pulling back any indicators. In looking at the miner configuration I didn't see a place for the "saved_serach" entry and added a variable to the configuration called saved_search. Was wondering if you would be able to provide any insight as to what I may be doing incorrectly.
age_out:
default: 7d
interval: 600
sudden_death: true
attributes:
confidence: 60
share_level: green
type: IPv4
extractor: results
fields: entity
password: <password>
prefix: None
search_name: <search_name>
url: https://<host>.splunkcloud.com:8089/services/search/jobs 
username: <username>
verify_cert: false

 

also tried with "https://xxx.splunkcloud.com:8089/servicesNS/nobody/<APP_NAME>/search/jobs/"

@Joel_Fostano ,  it has been a few years so I've forgotten the details,  but my prototype looks like yours:

 

HughKelley_0-1657847680393.png

 

It pulls the search_name setting the same way it gets the time settings (line 21 at URL below)

 

splunksearchminer/node.py 

 

If you look in the _internal index of Splunk, do you see any evidence of a search?

  • 4303 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!