-
Notifications
You must be signed in to change notification settings - Fork 7
/
Copy pathCYA_Export_For_MLTK_Splunk_Query
31 lines (29 loc) · 1.61 KB
/
CYA_Export_For_MLTK_Splunk_Query
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
# Copyright 2019 Paychex, Inc.
# Licensed pursuant to the terms of the Apache License, Version 2.0 (the "License");
# your use of the Work is subject to the terms and conditions of the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor
# provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including,
# without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT,
# MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible
# for determining the appropriateness of using or redistributing the Work and assume
# any risks associated with your exercise of permissions under this License.
| rest splunk_server="local"
[| rest splunk_server=local /services/authentication/current-context
| table username
| rename username as search
| eval search="servicesNS/".search."/Splunk_ML_Toolkit/mltk/experiments"]
| eval type="MLTK experiments"
| eval entry= spath(value, "entry{}")
| eval type="MLTK Experiments"
| mvexpand entry
| table type entry
| spath input=entry
| search author=[| makeresults count=1 | eval username="$username$" | eval search="\"".mvfilter(NOT match(username,"username"))."\"" | table search | append
[| rest splunk_server=local /services/authentication/current-context | table username | rename username as search | eval search="\"".search."\""]
| stats list(search) as search | eval search=mvindex(search, 0)]
| fields - entry