mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
1020 B
1020 B
Untitled string in Baseline Schema Schema
#/properties/search#/properties/search
The Splunk search for the baseline
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In |
|---|---|---|---|---|---|---|---|
| Can be instantiated | No | Unknown status | Unknown identifiability | Forbidden | Allowed | none | baselines.spec.json* |
search Type
string
search Examples
>-
cloudtrail StartInstances | stats earliest(_time) as earliest latest(_time) as
latest by awsRegion | outputlookup previously_seen_aws_regions.csv