admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
CleanUpDatamodelsAndRequiredFields
splunk-security_content/bin/datamodels/Splunk_Audit.json
T

1303 lines
39 KiB
JSON
Raw Permalink Blame History

{
"modelName": "Splunk_Audit",
"displayName": "Splunk Audit Logs",
"description": "Splunk Audit Logs Data Model",
"editable": false,
"objects": [
{
"objectName": "Datamodel_Acceleration",
"displayName": "Data Model Acceleration",
"parentName": "BaseSearch",
"fields": [
{
"comment": {
"description": "The number of times the data model summary has been accessed since it was created.",
"ta_relevant": false
},
"fieldName": "access_count",
"displayName": "access_count",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The timestamp of the most recent access of the data model summary.",
"ta_relevant": false
},
"fieldName": "access_time",
"displayName": "access_time",
"type": "timestamp",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The application context in which the data model summary was accessed.",
"ta_relevant": false
},
"fieldName": "app",
"displayName": "app",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The number of index buckets spanned by the data model acceleration summary.",
"ta_relevant": false
},
"fieldName": "buckets",
"displayName": "buckets",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The total size of the buckets spanned by the data model acceleration summary.",
"ta_relevant": false
},
"fieldName": "buckets_size",
"displayName": "buckets_size",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The cron expression used to accelerate the data model.",
"ta_relevant": false
},
"fieldName": "cron",
"displayName": "cron",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The percentage of the data model summary that is currently complete.",
"ta_relevant": false
},
"fieldName": "complete",
"displayName": "complete",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The name of the data model accelerated.",
"ta_relevant": false
},
"fieldName": "datamodel",
"displayName": "datamodel",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "A hash of the current data model contents.",
"ta_relevant": false
},
"fieldName": "digest",
"displayName": "digest",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The earliest time that the data model summary was accessed.",
"ta_relevant": false
},
"fieldName": "earliest",
"displayName": "earliest",
"type": "timestamp",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "Indicates whether the data model acceleration is currently in progress.",
"expected_values": [
"true",
"false",
"1",
"0"
],
"ta_relevant": false
},
"fieldName": "is_inprogress",
"displayName": "is_inprogress",
"type": "boolean",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The text of the last error reported during the data model acceleration.",
"ta_relevant": false
},
"fieldName": "last_error",
"displayName": "last_error",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The search id of the last acceleration attempt.",
"ta_relevant": false
},
"fieldName": "last_sid",
"displayName": "last_sid",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The most recent acceleration timestamp of the data model.",
"ta_relevant": false
},
"fieldName": "latest",
"displayName": "latest",
"type": "timestamp",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The timestamp of the most recent modification to the data model acceleration.",
"ta_relevant": false
},
"fieldName": "mod_time",
"displayName": "mod_time",
"type": "timestamp",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The length of time that data model accelerations are retained, in seconds.",
"ta_relevant": false
},
"fieldName": "retention",
"displayName": "retention",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The amount of storage space the data model's acceleration summary takes up, in bytes.",
"ta_relevant": false
},
"fieldName": "size",
"displayName": "size",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The unique id of the data model acceleration summary.",
"ta_relevant": false
},
"fieldName": "summary_id",
"displayName": "summary_id",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"calculations": [
],
"constraints": [
],
"baseSearch": "| `cim_datamodelinfo`",
"children": [
]
},
{
"comment": {
"ta_relevant": false
},
"objectName": "Search_Activity",
"displayName": "Search Activity",
"parentName": "BaseEvent",
"fields": [
{
"comment": {
"description": "The action of the search (granted, completed, cancelled, failed)."
},
"fieldName": "info",
"displayName": "info",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
},
{
"comment": {
"description": "The earliest time of the search."
},
"fieldName": "search_et",
"displayName": "search_et",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The latest time of the search."
},
"fieldName": "search_lt",
"displayName": "search_lt",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The total run time of the search."
},
"fieldName": "total_run_time",
"displayName": "total_run_time",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "user_bunit",
"displayName": "user_bunit",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "user_category",
"displayName": "user_category",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "user_priority",
"displayName": "user_priority",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"calculations": [
{
"calculationID": "0Search_Activity_user",
"calculationType": "Rex",
"inputField": "_raw",
"outputFields": [
{
"comment": {
"description": "The name of the user who ran the search."
},
"fieldName": "user",
"displayName": "user",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "user=(?<user>[^,]+), action"
},
{
"calculationID": "1Search_Activity_datamodel",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The name of the datamodel (for datamodel acceleration searches)."
},
"fieldName": "datamodel",
"displayName": "datamodel",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "case(match(savedsearch_name, \"_ACCELERATE_DM_.*\"), replace(savedsearch_name, \"_ACCELERATE_DM_(.*)_ACCELERATE_\", \"\\1\"), match(search, \"'?(\\|\\s+)?summarize.*?id=DM_\"), replace(search, \"'?(?:\\|\\s)?summarize.*?id=DM_([^\\s]+).*\", \"\\1\"), 1=1, null())"
},
{
"calculationID": "2Search_Activity_search_id",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The ID of the search."
},
"fieldName": "search_id",
"displayName": "search_id",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "trim(search_id, \"'\")"
},
{
"calculationID": "3Search_Activity_savedsearch_name",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The name of the saved search."
},
"fieldName": "savedsearch_name",
"displayName": "savedsearch_name",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(savedsearch_name=\"\",null(),savedsearch_name)"
},
{
"calculationID": "4Search_Activity_search",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The SPL search syntax."
},
"fieldName": "search",
"displayName": "search",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(isnull(search) OR search=\"\",null(),search)"
},
{
"calculationID": "5Search_Activity_search_type",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The type of search."
},
"fieldName": "search_type",
"displayName": "search_type",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "case(isnotnull(search_type) AND NOT search_type LIKE \"case(%\",search_type,savedsearch_name LIKE \"_ACCELERATE_DM%\", \"dm_acceleration\", search_id LIKE \"scheduler%\", \"scheduled\", search_id LIKE \"rt%\", \"realtime\", search_id LIKE \"subsearch%\", \"subsearch\", (search_id LIKE \"SummaryDirector%\" OR search_id LIKE \"summarize_SummaryDirector%\"), \"summary_director\", 1=1, \"adhoc\")"
},
{
"calculationID": "6Search_Activity_search_alias",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "Short description of the type of search being run, such as the name of the search or the name of the data model being accelerated."
},
"fieldName": "search_alias",
"displayName": "search_alias",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "case(isnotnull(datamodel) AND search_id LIKE \"SummaryDirector%\",datamodel.\" Data Model Summary Director\",isnotnull(datamodel),datamodel.\" Data Model Acceleration\",isnotnull(savedsearch_name),savedsearch_name,1=1,null())"
}
],
"constraints": [
{
"search": "index=_audit action=search search_id=*"
}
],
"children": [
]
},
{
"objectName": "Acceleration_Jobs",
"displayName": "Acceleration Jobs",
"parentName": "Search_Activity",
"fields": [
],
"calculations": [
],
"constraints": [
{
"search": "search_type=\"dm_acceleration\" OR search_type=\"summary_director\""
}
],
"children": [
]
},
{
"objectName": "Adhoc_Jobs",
"displayName": "Adhoc Jobs",
"parentName": "Search_Activity",
"fields": [
],
"calculations": [
],
"constraints": [
{
"search": "search_type=\"adhoc\""
}
],
"children": [
]
},
{
"objectName": "Failed_Jobs",
"displayName": "Failed Jobs",
"parentName": "Search_Activity",
"fields": [
],
"calculations": [
],
"constraints": [
{
"search": "info=\"failed\""
}
],
"children": [
]
},
{
"objectName": "Realtime_Jobs",
"displayName": "Real-time Jobs",
"parentName": "Search_Activity",
"fields": [
],
"calculations": [
],
"constraints": [
{
"search": "search_type=\"realtime\""
}
],
"children": [
]
},
{
"objectName": "Scheduled_Jobs",
"displayName": "Scheduled Jobs",
"parentName": "Search_Activity",
"fields": [
],
"calculations": [
],
"constraints": [
{
"search": "search_type=\"scheduled\""
}
],
"children": [
]
},
{
"objectName": "Subsearch_Jobs",
"displayName": "Subsearch Jobs",
"parentName": "Search_Activity",
"fields": [
],
"calculations": [
],
"constraints": [
{
"search": "search_type=\"subsearch\""
}
],
"children": [
]
},
{
"objectName": "Scheduler_Activity",
"displayName": "Scheduler Activity",
"parentName": "BaseSearch",
"fields": [
{
"comment": {
"description": "The event timestamp expressed in Unix time.",
"ta_relevant": false
},
"fieldName": "_time",
"displayName": "_time",
"type": "timestamp",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The app context in which the scheduled search was run.",
"ta_relevant": false
},
"fieldName": "app",
"displayName": "app",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The host on which the scheduled search was run.",
"ta_relevant": false
},
"fieldName": "host",
"displayName": "host",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The name of the saved search.",
"ta_relevant": false
},
"fieldName": "savedsearch_name",
"displayName": "savedsearch_name",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The search id.",
"ta_relevant": false
},
"fieldName": "sid",
"displayName": "sid",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The source associated with the scheduled search.",
"ta_relevant": false
},
"fieldName": "source",
"displayName": "source",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The source type associated with the scheduled search.",
"ta_relevant": false
},
"fieldName": "sourcetype",
"displayName": "sourcetype",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The Splunk Server on which the scheduled search runs.",
"ta_relevant": false
},
"fieldName": "splunk_server",
"displayName": "splunk_server",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The status of the scheduled search.",
"ta_relevant": false
},
"fieldName": "status",
"displayName": "status",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The user who scheduled the search.",
"ta_relevant": false
},
"fieldName": "user",
"displayName": "user",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "user_bunit",
"displayName": "user_bunit",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "user_category",
"displayName": "user_category",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "user_priority",
"displayName": "user_priority",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"calculations": [
],
"constraints": [
],
"baseSearch": "index=_internal sourcetype=scheduler",
"children": [
]
},
{
"objectName": "View_Activity",
"displayName": "View Activity",
"parentName": "BaseEvent",
"fields": [
{
"comment": {
"description": "The app name which contains the view.",
"ta_relevant": false
},
"fieldName": "app",
"displayName": "app",
"type": "string",
"fieldSearch": "",
"required": true,
"multivalue": false,
"hidden": false
}, {
"comment": {
"description": "The amount of time spent loading the view (in milliseconds).",
"ta_relevant": false
},
"fieldName": "spent",
"displayName": "spent",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The uniform resource identifier of the view activity.",
"ta_relevant": false
},
"fieldName": "uri",
"displayName": "uri",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The username of the user who accessed the view.",
"ta_relevant": false
},
"fieldName": "user",
"displayName": "user",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "user_bunit",
"displayName": "user_bunit",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "user_category",
"displayName": "user_category",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "user_priority",
"displayName": "user_priority",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The name of the view.",
"ta_relevant": false
},
"fieldName": "view",
"displayName": "view",
"type": "string",
"fieldSearch": "",
"required": true,
"multivalue": false,
"hidden": false
}
],
"calculations": [
],
"constraints": [
{
"search": "index=_internal sourcetype=splunk_web_access method=GET status=200"
}
],
"children": [
]
},
{
"objectName": "Web_Service_Errors",
"displayName": "Web Service Errors",
"parentName": "BaseSearch",
"fields": [
{
"comment": {
"description": "The event timestamp expressed in Unix time.",
"ta_relevant": false
},
"fieldName": "_time",
"displayName": "_time",
"type": "timestamp",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The host on which the web service error occurred.",
"ta_relevant": false
},
"fieldName": "host",
"displayName": "host",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The source where the web service error occurred.",
"ta_relevant": false
},
"fieldName": "source",
"displayName": "source",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The source type associated with the web service error.",
"ta_relevant": false
},
"fieldName": "sourcetype",
"displayName": "sourcetype",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"calculations": [
],
"constraints": [
],
"baseSearch": "index=_internal sourcetype=splunk_web_service tag=error",
"children": [
]
},
{
"comment": {
"tags": [
"modaction"
]
},
"objectName": "Modular_Actions",
"displayName": "Modular Actions",
"parentName": "BaseEvent",
"fields": [
{
"comment": {
"description": "The app ID of the app or add-on that owns the action.",
"ta_relevant": false
},
"fieldName": "app",
"displayName": "app",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "Specifies whether the action was executed as an ad hoc action or from a saved search, based on whether a search_name exists.",
"expected_values": [
"saved",
"adhoc"
],
"ta_relevant": false
},
"fieldName": "action_mode",
"displayName": "action_mode",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The status of the action. For example, 'success' or 'failure'.",
"ta_relevant": false
},
"fieldName": "action_status",
"displayName": "action_status",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The component of the modular action script involved in the event. Often used in conjunction with duration.",
"ta_relevant": false
},
"fieldName": "component",
"displayName": "component",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "How long the action took to complete, in milliseconds.",
"ta_relevant": false
},
"fieldName": "duration",
"displayName": "duration",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The id associated with the result of a specific sid. By default, this is the row number of the search, starting with 0.",
"ta_relevant": false
},
"fieldName": "rid",
"displayName": "rid",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The original sid value of a source action, automatically added to an event if it is the product of a previously executed action.",
"ta_relevant": false
},
"fieldName": "orig_sid",
"displayName": "orig_sid",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The rid value of a source action result, automatically added to an event if it is the product of a previously executed action.",
"ta_relevant": false
},
"fieldName": "orig_rid",
"displayName": "orig_rid",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The name of the correlation search that triggered the action. Blank for ad hoc actions.",
"ta_relevant": false
},
"fieldName": "search_name",
"displayName": "search_name",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "user_bunit",
"displayName": "user_bunit",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "user_category",
"displayName": "user_category",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "user_priority",
"displayName": "user_priority",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"calculations": [
{
"calculationID": "Modular_Actions_fillnull_action_name",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The name of the action.",
"ta_relevant": false
},
"fieldName": "action_name",
"displayName": "action_name",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "case(isnotnull(action_name) AND action_name!=\"\",action_name,sourcetype=\"splunkd\" AND isnotnull(action) AND action!=\"\",action,1=1,\"unknown\")"
},
{
"calculationID": "Modular_Actions_fillnull_signature",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The logging string associated with alert action introspection events.",
"ta_relevant": false
},
"fieldName": "signature",
"displayName": "signature",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(isnull(signature) OR signature=\"\",\"unknown\",signature)"
},
{
"calculationID": "Modular_Actions_fillnull_sid",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The search id, automatically assigned by splunkd.",
"ta_relevant": false
},
"fieldName": "sid",
"displayName": "sid",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(isnull(sid) OR sid=\"\",\"unknown\",sid)"
},
{
"calculationID": "Modular_Actions_user_or_owner",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The user who triggered an ad hoc alert. Not relevant for actions triggered by searches.",
"ta_relevant": false
},
"fieldName": "user",
"displayName": "user",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(isnotnull(user) AND user!=\"\",user,owner)"
},
{
"calculationID": "Modular_Actions_worker",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The worker performing the action.",
"ta_relevant": false
},
"fieldName": "worker",
"displayName": "worker",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(isnotnull(worker) AND worker!=\"\",\"unknown\",worker)"
}
],
"constraints": [
{
"search": "tag=modaction"
}
],
"children": [
]
},
{
"comment": {
"tags": [
"modaction",
"invocation"
]
},
"objectName": "Modular_Action_Invocations",
"displayName": "Modular Action Invocations",
"parentName": "Modular_Actions",
"fields": [
],
"calculations": [
],
"constraints": [
{
"search": "tag=invocation"
}
],
"children": [
]
}
]
}
Reference in New Issue View Git Blame Copy Permalink