elasticquerystats

The command elasticquerystats queries aggregated data in Elasticsearch with a DSL query saved in ElasticSPL. Queries run by elasticquerystats return aggregated data as results. Therefore, the data is formatted as a table. Timestamp fields and dynamic timestamp parsing are available with the command even though the returned data does not need to be time-series data.

Arguments

argument	required	format	description
instance	yes	string	elastic instance used by the query
search_name	yes	string	name of the saved query
timestamp_field	no	string	field in Elasticsearch data containing the events timestamp
timestamp_used	no	boolean	defines if the time given in the Splunk Search is used for the query
replacements	no	string	kv-pairs used to replace tokens in query

A saved DSL query defines default values for timestamp_field, timestamp_used, timestamp_format, and replacements`. As long as the user does not provide the argument, the value stored with the query is used. In case of replacements, the KV-pairs are merged. The user-provided input takes precedence if there is a definition for a key in the user's input and the saved arguments.

Examples

Get a distribution over the sales of products by time and product category

Kibana Graph

Default Values

Default Field	Default Value
timestamp_field
timestamp_used	false
timestamp_format
replacements

Saved Query

{
   "aggs":{
      "0":{
         "terms":{
            "field":"category.keyword",
            "order":{
               "_count":"desc"
            },
            "size":100
         },
         "aggs":{
            "1":{
               "date_histogram":{
                  "field":"order_date",
                  "calendar_interval":"1h",
                  "time_zone":"Europe/Zurich"
               }
            }
         }
      }
   },
   "size":0,
   "fields":[
      {
         "field":"customer_birth_date",
         "format":"date_time"
      },
      {
         "field":"order_date",
         "format":"date_time"
      },
      {
         "field":"products.created_on",
         "format":"date_time"
      }
   ],
   "script_fields":{
      
   },
   "stored_fields":[
      "*"
   ],
   "runtime_mappings":{
      
   },
   "_source":{
      "excludes":[
         
      ]
   }
}

Splunk Search

| elasticquerystats instance="dev" search_name="docs_1" timestamp_used=false
| spath input=bucket output=buckets path=1.buckets{}
| spath input=bucket output=product_type path=key
| fields product_type buckets
| mvexpand buckets
| spath input=buckets
| eval _time = key / 1000
| timechart span=24h sum(doc_count) by product_type

Splunk Graph

Permissions

Each query is assigned to at least one role. In addition to capability checks on the operations list, run, and crud on a query, the assigned roles are checked. Users interacting with a query have to have at least one role in common.

List

The capability list_elastic_query is required to be able to view any queries. This capability is by default enabled for the role elastic_query_list. The app checks for overlap in roles while loading queries and only show relevant queries to the user.

Run

The capability run_elastic_query is required to run any query. This capability is by default enabled for the role elastic_query_run. As a user needs to be able to list queries to run them, the role imports elastic_query_list.

At the execution of a query, the app checks if the user and query have any roles in common. The execution stops, and an error message appears if there is no overlap in roles. Additionaly, the command checks if the current user is allowed to run any queries against the provided instance.

CRUD

The capability edit_elastic_query is required to perform any CRUD action. This capability is by default enabled for the role elastic_query_edit. The role elastic_query_edit imports both elastic_query_run and elastic_query_list.