harvest_labels
Extract field names, types, sample values, and metadata from Splunk indexes to identify schemas. Optionally focus on CIM fields to support SOC investigations.
Instructions
Discover field labels and schemas from Splunk indexes.
This tool harvests field names, types, sample values, and metadata from Splunk indexes to support DeepTempo training and evaluation. It can discover all fields or focus on CIM (Common Information Model) fields only.
Args: indexes: List of specific indexes to harvest (None = all indexes) focus_cim: If True, only return common CIM fields (src_ip, dest_ip, user, etc.) max_sample_events: Number of events to sample for field value examples timeframe: Time range to analyze for field discovery (e.g., "-24h", "-7d")
Returns: Dictionary containing: - harvest_timestamp: ISO-8601 timestamp of harvest - indexes_analyzed: List of indexes analyzed - total_fields_discovered: Total number of unique fields found - fields: Dictionary mapping field names to their metadata
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| indexes | No | ||
| focus_cim | No | ||
| timeframe | No | -24h | |
| max_sample_events | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |