Skip to content

MineMeld miner to retrieve Splunk search results as indicators

License

Notifications You must be signed in to change notification settings

hkelley/splunksearch-miner

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

22 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

splunksearch-miner

MineMeld miner for Splunk searches implemented as an extension

How it works

This miner periodically executes a Splunk saved search via REST and returns a columns as indicators.

Installation

Install this extension directly from the git repo using your MineMeld server's System | Extensions menu.

Configuration

I should re-work this so that the username and password go in the private (node-level) storage. Someday ....

  • If your saved search is not in the default search app then use a URL like this: "https://xxx.splunkcloud.com:8089/servicesNS/nobody/<APP_NAME>/search/jobs/"
  • User role permissions will suffice
  • In the prototype configuration, use double-quotes around the search name, password, or anywhere else that has YAML special characters.

About

MineMeld miner to retrieve Splunk search results as indicators

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages