Adding semantic jobs API

Author: gjanders

README.md

@@ -366,6 +366,10 @@ New alerts:
 New reports:
 - `SearchHeadLevel - indexes per dashboard`
 
+Updated reports/alerts:
+- `SearchHeadLevel - Excessive REST API usage` - added semantic jobs endpoints
+- `SearchHeadLevel - platform_stats access summary` - added semantic jobs endpoints
+
 ### 4.0.4
 New reports:
 - `SearchHeadLevel - access logs kvstore usage`

default/savedsearches.conf

@@ -5309,10 +5309,10 @@ search = | multisearch \
     | rex field=decoded_uri_query "/saved/searches/(?P<report>[^&]+)" \
     | eval report=urldecode(report), source="splunk_web_access" ] \
     [ search index=_internal `searchheadhosts` method=GET sourcetype=splunkd_ui_access \
-    | regex uri="^(/([^/]+/){2}__raw/services/search/jobs\?output_mode=json&id=)|(/([^/]+/){2}__raw/servicesNS/([^/]+/){2}search/jobs/[^\?/]+\?output)" \
+    | regex uri="^(/([^/]+/){2}__raw/services/search/(v1/|v2/)?jobs\?output_mode=json&id=)|(/([^/]+/){2}__raw/servicesNS/([^/]+/){2}search/jobs/(v1/|v2/)?[^\?/]+\?output)" \
     | rex field=uri "id=(?P<sid>[^&]+)" max_match=20 \
     | eval app=null(), report=null(), view=null() \
-    | rex field=uri "^/([^/]+/){2}__raw/servicesNS/([^/]+/)(?P<app>[^/]+)/search/jobs/(?P<sid_2>[^\?]+)\?output" \
+    | rex field=uri "^/([^/]+/){2}__raw/servicesNS/([^/]+/)(?P<app>[^/]+)/search/jobs/(v1/|v2/)?(?P<sid_2>[^\?]+)\?output" \
     | eval sid=coalesce(sid,sid_2), prebintime=_time, source="splunkd_ui_access" \
     | bin _time span=2m] \
     [ search index=_internal `searchheadhosts` method=POST status=201 sourcetype=splunkd_ui_access \
@@ -7267,13 +7267,13 @@ quantity = 0
 relation = greater than
 request.ui_dispatch_app = SplunkAdmins
 request.ui_dispatch_view = search
-search = ```attempt to detect overuse of the REST API by non-system users``` index=_internal `searchheadhosts` sourcetype=splunkd_access useragent!="Splunk/*" useragent!="Splunkd/*" user!=splunk-system-user user!=admin user!=- NOT "/results_preview" "/search/jobs/" clientip!="127.0.0.1" ```this is the splunk internal httplib version proxying requests on behalf of clients this will likely change on upgrade, current as of 8.2.2.1``` NOT (`splunkadmins_excessive_rest_api_httplib` "isProxyRequest=true")\
+search = ```attempt to detect overuse of the REST API by non-system users``` index=_internal `searchheadhosts` sourcetype=splunkd_access useragent!="Splunk/*" useragent!="Splunkd/*" user!=splunk-system-user user!=admin user!=- NOT "/results_preview" ("/search/jobs/" OR "/search/v1/jobs/" OR "/search/v2/jobs/") clientip!="127.0.0.1" ```this is the splunk internal httplib version proxying requests on behalf of clients this will likely change on upgrade, current as of 8.2.2.1``` NOT (`splunkadmins_excessive_rest_api_httplib` "isProxyRequest=true")\
 | regex uri!="/control$" \
 | bin _time span=2m \
 | stats count by user, _time \
 | where count>`splunkadmins_excessive_rest_api_threshold` \
 | eval earliest=_time-120, latest=_time+120 \
-| eval query="index=_internal `searchheadhosts` sourcetype=splunkd_access useragent!=\"Splunk/*\" useragent!=\"Splunkd/*\" user!=splunk-system-user user!=admin user!=- NOT \"/results_preview\" \"/search/jobs/\" clientip!=\"127.0.0.1\" NOT (\"Python-httplib2/0.13.1 (gzip)\" \"isProxyRequest=true\") user=" . user . " earliest=" . earliest . " latest=" . latest . " | regex uri!=\"/control$\" | rex field=uri \"/(?P<last_of_url>[^/]+$)\" | streamstats current=false last(_time) AS prev_time by last_of_url | eventstats count AS count_by_last_of_url by last_of_url | eval time_diff=if(isnull(prev_time),null(),prev_time-_time)" \
+| eval query="index=_internal `searchheadhosts` sourcetype=splunkd_access useragent!=\"Splunk/*\" useragent!=\"Splunkd/*\" user!=splunk-system-user user!=admin user!=- NOT \"/results_preview\" (\"/search/jobs/\"  OR \"/search/v1/jobs/\" OR \"/search/v2/jobs/\") clientip!=\"127.0.0.1\" NOT (\"Python-httplib2/0.13.1 (gzip)\" \"isProxyRequest=true\") user=" . user . " earliest=" . earliest . " latest=" . latest . " | regex uri!=\"/control$\" | rex field=uri \"/(?P<last_of_url>[^/]+$)\" | streamstats current=false last(_time) AS prev_time by last_of_url | eventstats count AS count_by_last_of_url by last_of_url | eval time_diff=if(isnull(prev_time),null(),prev_time-_time)" \
 | fields - earliest, latest\
 | sort - count
 disabled = 1