🩺 Auditing & Health Checks

← Back to Categories
Category Description Action
⏱️ Health Checks Easily Check Cron Schedule in a Bar Graph 
index=_internal sourcetype=scheduler   host=YOURHOST* OR host=YOUROTHERHOST* app=SplunkEnterpriseSecuritySuite status=success 
| timechart span=1m count by savedsearch_name limit=200
⏱️ Health Checks Average Run time of scheduled correlation searches 
index=_audit   sourcetype=audittrail (host=YOURHOST* OR host=YOUROTHERHOST* ) savedsearch_name!="" action=search app=SplunkEnterpriseSecuritySuite NOT info=granted (savedsearch_name="access *" OR savedsearch_name="endpoint *" OR savedsearch_name="threat *" OR savedsearch_name="network *" OR savedsearch_name="identity *" OR savedsearch_name="audit *")
| stats  avg(total_run_time) as avg_runtime, count(eval(info="bad_request")) as bad_request, count(eval(info="failed")) as failed, count(eval(info="completed")) as completed,by savedsearch_name 
| eval avg_runtime=round(avg_runtime,2)
| timechart avg(total_run_time)
⏱️ Health Checks Simply list all enabled searches and their Cron Schedule 
index=_audit   sourcetype=audittrail (host=YOURHOST* OR host=YOUROTHERHOST* ) savedsearch_name!="" action=search app=SplunkEnterpriseSecuritySuite NOT info=granted (savedsearch_name="access *" OR savedsearch_name="endpoint *" OR savedsearch_name="threat *" OR savedsearch_name="network *" OR savedsearch_name="identity *" OR savedsearch_name="audit *")
| stats  avg(total_run_time) as avg_runtime, count(eval(info="bad_request")) as bad_request, count(eval(info="failed")) as failed, count(eval(info="completed")) as completed,by savedsearch_name 
| eval avg_runtime=round(avg_runtime,2)
🔥 Notable Events Notable Events over 30 days 
index=notable sourcetype=stash 
| eval search_name=replace(search_name," - Rule", "")
| timechart count by search_name limit=100
🔥 Notable Events Notable Events over 24 hours 
index=notable sourcetype=stash 
| eval search_name=replace(search_name," - Rule", "")
| timechart span=1h count by search_name limit=100
🛡️ RBA Alerts RBA Alerts over 30 days 
index=risk sourcetype=stash 
| eval search_name=replace(search_name," - Rule", "")
| timechart count by search_name limit=100