Skip to content

Latest commit

 

History

History
17 lines (12 loc) · 788 Bytes

README.md

File metadata and controls

17 lines (12 loc) · 788 Bytes

splunksearch-miner

MineMeld miner for Splunk searches implemented as an extension

How it works

This miner periodically executes a Splunk saved search via REST and returns a columns as indicators.

Installation

Install this extension directly from the git repo using your MineMeld server's System | Extensions menu.

Configuration

I should re-work this so that the username and password go in the private (node-level) storage. Someday ....

  • If your saved search is not in the default search app then use a URL like this: "https://xxx.splunkcloud.com:8089/servicesNS/nobody/<APP_NAME>/search/jobs/"
  • User role permissions will suffice
  • In the prototype configuration, use double-quotes around the search name, password, or anywhere else that has YAML special characters.