diff --git a/app_template/README/essoc_usage_dashboard.txt b/app_template/README/essoc_usage_dashboard.txt deleted file mode 100644 index fcbc842881..0000000000 --- a/app_template/README/essoc_usage_dashboard.txt +++ /dev/null @@ -1,51 +0,0 @@ -###################### -ESSOC Usage Dashboard# -###################### - -The ESSOC Usage dashboard is designed to provide high-level insight into the usage of the ES-SOC app. It is suitable for display when providing feedback to the Splunk team or for identifying how the ES-SOC app is being used. This dashboard has two time selectors that work independently - the top time selector determines the search time range for all the single-value. And the lower time selector, determines the time range for the usage table. - -IMPORTANT: The user loading this dashboard must have permission to search the _audit index - -################## -#Dashboard panels# -################## - -Searches Ran - -The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax - -Unique Searches - -The unique/distinct searches executed on the deployment. This is equivalent to the distinct count of searches run in the ES-SOC app. - -Most Run - -The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax. - -Ad hoc Searches - -The total number of searches run from the search bar using the '| savedsearch ‘ syntax. - -Scheduled - -The total number of ESSOC searches run that were scheduled. - -Most Active User - -The user who executed the highest number/count of searches. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax. - -Search Run Time (seconds) - -Total run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax. - -Average Run Time (seconds) - -Average run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax. - -Max Run Time (seconds) - -The run time of the longest running search. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax. - -Search summary - -This table provides details on each search that was executed in the ESSOC app. \ No newline at end of file diff --git a/app_template/default/analytic_stories.conf b/app_template/default/analytic_stories.conf deleted file mode 100644 index 0cfdca344c..0000000000 --- a/app_template/default/analytic_stories.conf +++ /dev/null @@ -1,2 +0,0 @@ -### Deprecated since ESCU UI was deprecated and this conf file is no longer in use -### Using one single file analyticstories.conf that will be used both by ES and ESCU \ No newline at end of file diff --git a/app_template/default/app.conf b/app_template/default/app.conf deleted file mode 100644 index c6991ff55b..0000000000 --- a/app_template/default/app.conf +++ /dev/null @@ -1,30 +0,0 @@ -## Splunk app configuration file - -[install] -is_configured = false -state = enabled -state_change_requires_restart = false -build = 16367 - -[triggers] -reload.analytic_stories = simple -reload.use_case_library = simple -reload.correlationsearches = simple -reload.analyticstories = simple -reload.governance = simple -reload.managed_configurations = simple -reload.postprocess = simple -reload.content-version = simple -reload.es_investigations = simple - -[launcher] -author = Splunk -version = 4.9.0 -description = Explore the Analytic Stories included with ES Content Updates. - -[ui] -is_visible = true -label = ES Content Updates - -[package] -id = DA-ESS-ContentUpdate diff --git a/app_template/default/commands.conf b/app_template/default/commands.conf deleted file mode 100644 index ad3cbfdfd0..0000000000 --- a/app_template/default/commands.conf +++ /dev/null @@ -1,11 +0,0 @@ -# deprecated please see gist: https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303ac1 -#[dnstwist] -#filename = dnstwist.py -#chunked = true - -# run story functionality has been moved to: https://github.com/splunk/analytic_story_execution' -# [runstory] -# filename = runstory.py -# chunked = true -# is_risky = true - diff --git a/app_template/default/content-version.conf b/app_template/default/content-version.conf deleted file mode 100644 index 4bbba5eb29..0000000000 --- a/app_template/default/content-version.conf +++ /dev/null @@ -1,2 +0,0 @@ -[content-version] -version = 4.9.0 diff --git a/app_template/default/use_case_library.conf b/app_template/default/use_case_library.conf deleted file mode 100644 index 0cfdca344c..0000000000 --- a/app_template/default/use_case_library.conf +++ /dev/null @@ -1,2 +0,0 @@ -### Deprecated since ESCU UI was deprecated and this conf file is no longer in use -### Using one single file analyticstories.conf that will be used both by ES and ESCU \ No newline at end of file diff --git a/app_template/metadata/default.meta b/app_template/metadata/default.meta index b9b933bfa5..7d1374800b 100644 --- a/app_template/metadata/default.meta +++ b/app_template/metadata/default.meta @@ -1,6 +1,6 @@ ## shared Application-level permissions [] -access = read : [ * ], write : [ admin ] +access = read : [ * ], write : [ admin, sc_admin ] export = system [savedsearches]