Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Saved searches should retrieve the last 24 hours instead of all time #78

Merged
merged 1 commit into from
Dec 9, 2024
Merged

Saved searches should retrieve the last 24 hours instead of all time #78

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions packages/flare/src/main/resources/splunk/default/savedsearches.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[Flare Search]
description = Shows all of the ingested events
search = source="flare"
description = Shows the ingested events from the last 24 hours
search = source="flare index=flare earliest=-24h latest=now"

[Severity]
description = Counts the events by severity
search = source=flare index=main | spath path=header.risk.score output=risk_score_str | eval risk_score = coalesce(tonumber(risk_score_str), 0) | eval risk_label = case(risk_score == 1, "Info", risk_score == 2, "Low", risk_score == 3, "Medium", risk_score == 4, "High", risk_score == 5, "Critical") | stats count by risk_label, risk_score | sort risk_score | fields - risk_score
description = Counts the events by severity in the last 24 hours
search = source=flare index=flare earliest=-24h latest=now | spath path=header.risk.score output=risk_score_str | eval risk_score = coalesce(tonumber(risk_score_str), 0) | eval risk_label = case(risk_score == 1, "Info", risk_score == 2, "Low", risk_score == 3, "Medium", risk_score == 4, "High", risk_score == 5, "Critical") | stats count by risk_label, risk_score | sort risk_score | fields - risk_score
1 change: 1 addition & 0 deletions packages/react-components/src/models/constants.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ export const APPLICATION_NAMESPACE: SplunkApplicationNamespace = {
sharing: 'app',
};
export const FLARE_SAVED_SEARCH_NAME = 'Flare Search';
export const SEVERITY_SAVED_SEARCH_NAME = 'Severity';
export const KV_COLLECTION_NAME = 'event_ingestion_collection';
export const KV_COLLECTION_KEY = '_key';
export const KV_COLLECTION_VALUE = 'value';
Expand Down
8 changes: 7 additions & 1 deletion packages/react-components/src/utils/setupConfiguration.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import {
KV_COLLECTION_NAME,
KV_COLLECTION_VALUE,
PasswordKeys,
SEVERITY_SAVED_SEARCH_NAME,
STORAGE_REALM,
} from '../models/constants';
import { Severity, SourceType, SourceTypeCategory, Tenant } from '../models/flare';
Expand Down Expand Up @@ -154,7 +155,12 @@ async function saveConfiguration(
await updateSavedSearchQuery(
service,
FLARE_SAVED_SEARCH_NAME,
`source=${APP_NAME} index=${indexName}`
`source=${APP_NAME} index=${indexName} earliest=-24h latest=now`
);
await updateSavedSearchQuery(
service,
SEVERITY_SAVED_SEARCH_NAME,
`source=${APP_NAME} index=${indexName} earliest=-24h latest=now | spath path=header.risk.score output=risk_score_str | eval risk_score = coalesce(tonumber(risk_score_str), 0) | eval risk_label = case(risk_score == 1, "Info", risk_score == 2, "Low", risk_score == 3, "Medium", risk_score == 4, "High", risk_score == 5, "Critical") | stats count by risk_label, risk_score | sort risk_score | fields - risk_score`
);
await completeSetup(service);
await reloadApp(service);
Expand Down
Loading