splunk-pack-all.conf

{
    "queries": {
        "etc_hosts_entries": {
            "query": "SELECT * FROM etc_hosts",
            "interval": 60
        },
        "route_table": {
            "query": "select * from routes",
            "interval": 60
        },
        "logged_in_users": {
            "query": "select type, user, tty, host, time, datetime(time,'unixepoch') || ' UTC' AS logon_time_readable, pid from logged_in_users",
            "interval": 120
        },
        "listening_ports": {
            "query": "select (select datetime from time) AS poll_time, processes.name, users.username, etc_protocols.name AS protocol, listening_ports.pid, listening_ports.port, listening_ports.family, listening_ports.address from listening_ports JOIN processes ON listening_ports.pid = processes.pid JOIN users ON processes.uid = users.uid JOIN etc_protocols ON etc_protocols.number = listening_ports.protocol where listening_ports.port > 0",
            "interval": 300,
            "removed": false
        },
        "top_10_processes_memory_usage": {
            "query": "select (select datetime from time) AS poll_time, processes.pid, processes.path, processes.name, processes.uid, users.username, processes.resident_size, processes.total_size, processes.user_time, processes.system_time, processes.disk_bytes_read, processes.disk_bytes_written, processes.handle_count, processes.percent_processor_time, users.username, datetime(processes.start_time,'unixepoch') || ' UTC' AS start_time_readable, users.username from processes JOIN users ON processes.uid = users.uid order by resident_size desc limit 10",
            "interval": 600,
            "removed": false
        },
        "top_10_processes_most_active": {
            "query": "select (select datetime from time) AS poll_time, processes.pid, processes.name, processes.path, processes.uid, users.username, count(pid) as total_threads, processes.resident_size, processes.total_size, processes.user_time, processes.system_time, processes.disk_bytes_read, processes.disk_bytes_written, processes.handle_count, processes.percent_processor_time, users.username, datetime(processes.start_time,'unixepoch') || ' UTC' AS start_time_readable from processes JOIN users ON processes.uid = users.uid group by name order by total_threads desc limit 10",
            "interval": 600,
            "removed": false
        },
        "users": {
            "query": "select * from users",
            "interval": 3600
        },
        "groups": {
            "query": "select * from groups",
            "interval": 3600
        },
        "interface_addresses": {
            "query": "select (select datetime from time) AS poll_time, * from interface_addresses",
            "interval": 14400,
            "removed": false
        },
        "interface_details": {
            "query": "select (select datetime from time) AS poll_time, * from interface_details",
            "interval": 14400,
            "removed": false
        },
        "ntp_check": {
            "query": "select datetime(local_time, 'unixepoch', 'localtime') as localtime, local_timezone, unix_time, timestamp from time;",
            "interval": 14400,
            "snapshot": true
        },
        "system_info": {
            "query": "select * from system_info;",
            "interval": 604800,
            "snapshot": true
        }
    }
}