Attributes from Splunk ES Correlation Search Entry about splunk-sdk-java

[bparmar-splunk]

Hi @nhalstead,
We have tested SavedSearch using Postman and yes attributes do exist. Whereas in case of fetching those attributes from SDK, it is possible to fetch all the above mentioned values. Please find below code snippet for reference.

SavedSearchCollection collection = service.getSavedSearches(); // service is instance of Service class.
if (collection != null && collection.size() > 0) {

    collection.keySet().forEach(key -> {

        SavedSearch savedSearch = collection.get(key);
        if (savedSearch != null && savedSearch.getBoolean("action.correlationsearch.enabled", false)) {

            System.out.println(
                    "Label : " + savedSearch.get("action.correlationsearch.label")
                    + ", Notable : " + savedSearch.get("action.notable")
                    + ", Sec. Domain : " + savedSearch.get("action.notable.param.security_domain")
                    + ", Severity : " + savedSearch.get("action.notable.param.severity")
                    + ", Risk Score : " + savedSearch.get("action.risk.param._risk_score"));
        }
    });
}

Please check at your end and let us know, if you still face any issues.

[bparmar-splunk]

Hi @nhalstead,
We didn't receive any update from your side. So it seems all the required attributes are fetched by referring above snippet.
We are closing this ticket.

[bparmar-splunk]

Hi @nhalstead,
We hope you might have successfully fetched all the required attributes by referring above snippet.
Since there is no update from your side, we are closing this ticket.

[nhalstead]

Hi @bparmar-splunk, appreciate the response, finally had time to test it out.

The method getBoolean is not exported from the package (it has no access modifier so it's only available at the package level), so I'm not able to call that method!

My test code:

splunk-1.6.5.0.jar: com.splunk.Entity

[nhalstead]

There is a possible workaround since Entity::get is public, I can duplicate the getBoolean method to run the same check.