| import os | |
| import re | |
| import csv | |
| input_file = 'input.md' | |
| output_file = 'permission_table.csv' | |
| # Delete output file if it exists | |
| if os.path.exists(output_file): | |
| os.remove(output_file) |
| ```js | |
| // ==UserScript== | |
| // @name Extract Splunk Search Run Duration | |
| // @namespace http://* | |
| // @version 1.0 | |
| // @description This script extracts the a Splunk search's run duration and displays it in the title of the tab. | |
| // @match http://splunk.example.com:8000/* | |
| // @grant none | |
| // ==/UserScript== |
When run from a Splunk search head, this search will return sourcetypes seen that do not have apps with configs for the listed sourcetype.
For example, if it returns WinEventLog, you should download the Windows TA to perform search-time parsing for these events.
| tstats c where index=* by sourcetype
| append
[| rest /services/saved/sourcetypes splunk_server=local
| fields title eai:acl.app
| rename title as sourcetype, eai:acl.app as app