When you deploy Splunk Enterprise Security version 8.0 on Splunk Enterprise, the Splunk platform sends anonymized Splunk Mission Control usage data to Splunk Inc. ("Splunk") to help improve Splunk Enterprise Security in future releases. For information about how to opt in or out, and how the data is collected, stored, and governed, see Share data in Splunk Enterprise.
How data is collected
Splunk Mission Control uses saved searches to collect anonymous usage data. These searches run in the background regardless of whether or not you opt-in to send usage data to Splunk, and do not have any significant impact on performance.
What data is collected
Splunk Mission Control collects the following basic usage information:
Name | Description | Example |
---|---|---|
app.MissionControl.active_users |
Count of unique users accessing any views in the app. | app: missioncontrol begin: 1657929600 component: app.MissionControl.active_users data: { [-] admin_count: 3 count: 4 } datetime: 07-17-2022 04:11:18.749 +0000 deploymentID: CLOUD-00eddb5e-8dcf-560a-a6f2-ec09bed65be7 end: 1658016000 environment: stg eventID: 6CDDC009-F01B-4A46-BBD2-4CBC7C5FADF3 executionID: B7BDBBB1-399C-4B52-8EEC-F379323923B0 optInRequired: 3 stackID: 02e2d57eed3eb47a145cdd6faa72560699655114455afe9e7e8be6062a2b6554 timestamp: 1658030580 type: aggregate version: 1.0 visibility: anonymous |
app.MissionControl.configuration |
General configuration states of the app. | app: missioncontrol component: app.MissionControl.configuration data: { [-] accepted: 1 } datetime: 07-18-2022 04:21:19.637 +0000 deploymentID: CLOUD-00eddb5e-8dcf-560a-a6f2-ec09bed65be7 environment: stg eventID: 6AB73C72-1B31-4404-B001-7712DBA5083B executionID: 7DBF4251-C106-4020-A116-B0D40EBA605F optInRequired: 3 stackID: 02e2d57eed3eb47a145cdd6faa72560699655114455afe9e7e8be6062a2b6554 timestamp: 1658117562 type: aggregate version: 1.0 visibility: anonymous |
app.MissionControl.incidents |
Count of incidents created in the last 24 hours and metadata about them. | app: missioncontrol begin: 1658016000 component: app.MissionControl.incidents data: { [-] has_notable_count: 192 incidents_count: 192 incidents_with_response_plans: 192 } datetime: 07-18-2022 04:15:07.575 +0000 deploymentID: CLOUD-d112a64c-6205-56c6-95b9-d641ca11a5ab end: 1658102400 environment: stg eventID: CE611F3D-8E50-4712-AC1B-F880D286D2B1 executionID: E8FB4DAB-A436-4AB7-853A-5FEBDA969A90 optInRequired: 3 stackID: 942d2b1e14de8665c6e25ce18209ae61eb30026e9576af52120896b209a3e6e6 timestamp: 1658117268 type: aggregate version: 1.0 visibility: anonymous |
app.MissionControl.responseplans |
Statistics about the count of response plans per incident. | app: missioncontrol component: app.MissionControl.responseplans data: { [-] avg_response_plans_per_incident: 1.4285714285714286 max_response_plans_per_incident: 2 min_response_plans_per_incident: 1 } datetime: 07-16-2022 04:25:05.005 +0000 deploymentID: CLOUD-d112a64c-6205-56c6-95b9-d641ca11a5ab environment: stg eventID: 2A92B5A9-3BF7-485E-BE12-A76E591B3B52 executionID: 75CE7772-2769-42E7-9ABB-114F3858F23E optInRequired: 3 stackID: 942d2b1e14de8665c6e25ce18209ae61eb30026e9576af52120896b209a3e6e6 timestamp: 1657945349 type: aggregate visibility: anonymous |
app.MissionControl.responseplanstasks |
Statistics about the count of tasks per response plan. | app: missioncontrol component: app.MissionControl.responseplantasks data: { [-] avg_tasks_count_in_response_plan: 19.413686534216335 max_tasks_count_in_response_plan: 28 min_tasks_count_in_response_plan: 9 } datetime: 07-17-2022 04:27:20.126 +0000 deploymentID: CLOUD-2cc191a3-94a8-54a0-b390-63b5665fad35 environment: stg eventID: 6FDC1B28-9B83-4C7D-A1D6-E9373ECF196A executionID: 34ABCD8B-7F61-46F1-966F-6ACFA6FD5F90 optInRequired: 3 stackID: ac88a9ea1646570463f40ec2e929581bfc3fae4380d1d936c0346a292ac8a25b timestamp: 1658032031 type: aggregate visibility: anonymous |
app.session.MissionControl.splSuccess |
Metadata about successful SPL queries triggered by the UI to power features in the app. | component: app.session.MissionControl.splSuccess data: { [-] action: searchResults.load app: missioncontrol executionTime: 4275.5 page: mc_incident_review pathname: /en-US/app/missioncontrol/mc_incident_review searchMacro: | `mc_incidents` sessionID: e16ae6b4-e407-4238-8bcb-a08aa05232ab } deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb eventID: 23792757-d7b1-0bf3-3329-68383fc0675f experienceID: f4c99b71-d781-9569-3eb4-a2306cde9a7c optInRequired: 3 splunkVersion: 9.0.0 timestamp: 1658189286 userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33 version: 4 visibility: anonymous,support |
app.session.MissionControl.splError |
Metadata about errors when making SPL queries from the UI. | component: app.session.MissionControl.splError data: { [-] action: searchResults.error app: missioncontrol executionTime: 34.39999997615814 page: mc_incident_review pathname: /en-US/app/missioncontrol/mc_incident_review searchMacro: | `mc_incidents` sessionID: b55ed6e3-e92d-4336-b074-54fe5f45987b } deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb eventID: b63f483f-fea3-3e23-b6b3-e7600b01ac9c experienceID: b26453d2-6630-784f-3624-98360be1e98e optInRequired: 3 splunkVersion: 9.0.0 timestamp: 1658188621 userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33 version: 4 visibility: anonymous,support |
app.session.MissionControl.pageView |
UI user access to sub-routes within the app. | component: app.session.MissionControl.pageView data: { [-] app: missioncontrol page: investigation/response pathname: /en-US/app/missioncontrol/mc_incident_review sessionID: 4775fa3c-ad77-4778-ac18-054c6d5ef120 } deploymentID: 5b0290bb-60fa-56eb-bd31-7a2b730c813a eventID: 78ff506d-ecda-d879-1aff-9516fb4e6cca experienceID: a1c94be3-aa5a-f047-8b75-b912125c6846 optInRequired: 3 timestamp: 1658188399 userID: 31b17c1d977a2df05a722cf9d9cc64cd66abf07776e107da51b9061bce07ec2f version: 4 visibility: anonymous,support |
app.session.MissionControl.uiError |
Any errors caught by the UI JavaScript code. | component: app.session.MissionControl.uiError data: { [-] app: missioncontrol error: Error: Unexpected error to get response templates errorType: errorBoundary page: mc_content pathname: /en-US/app/missioncontrol/mc_content sessionID: 3ce56857-84a2-4a53-9d14-1ab4328829af stackTrace: Error: Unexpected error to get response templates at ResponseTemplatesTable (webpack-internal:///./src/features/ResponseTemplates/templateListView/ResponseTemplatesTable.tsx:31:11) at renderWithHooks (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:14803:18) at updateFunctionComponent (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:17034:20) at beginWork (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:18610:16) at HTMLUnknownElement.callCallback (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:188:14) at Object.invokeGuardedCallbackDev (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:237:16) at invokeGuardedCallback (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:292:31) at beginWork$1 (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:23203:7) at performUnitOfWork (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:22157:12) at workLoopSync (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:22130:22) } deploymentID: 0bcca5d4-9af8-5f22-9899-7e463be6bac8 eventID: ab67c7cd-bc07-c6f5-eb87-916c46480611 experienceID: 59b8518a-3f68-06f5-c61f-73e8b6fb3c7e optInRequired: 3 timestamp: 1658186683 userID: 43bdc924ec0181df08203c5094df121ba564d7d44017898753f9a744231d684f version: 4 visibility: anonymous,support |
app.session.MissionControl.searchChange |
Tracking how users are using the custom search feature on the Incident Review page. | component: app.session.MissionControl.searchChange data: { [-] action: searchForIncidents.change app: missioncontrol page: mc_incident_review pathname: /en-US/app/missioncontrol/mc_incident_review sessionID: 099c92d2-f1ba-490f-873e-2bbfe9cc0f49 } deploymentID: ce48e2e4-155f-5b76-8a41-cbae3ba1ae0f eventID: 1c5ca745-6a6d-3b5c-7a2c-c710fe1f80b1 experienceID: 293f92a2-b1ba-08a9-1f73-6b5e74884cb7 optInRequired: 3 timestamp: 1658180323 userID: 4e0b955955b5623d11236342c14ae1cdf6dd7b59f1ddc4e65dda002ebd22e6fd version: 4 visibility: anonymous,support |
app.session.MissionControl.dateTimeFilterChange |
Tracking how users are using the data-range picker in the Incident Review page. | component: app.session.MissionControl.dateTimeFilterChange data: { [-] action: saveDateTimeRange.change app: missioncontrol dateTimeFilter: { [-] earliest: -30d@d latest: now } page: mc_incident_review pathname: /en-US/app/missioncontrol/mc_incident_review sessionID: 068474a2-96d0-4b7a-a86f-9511439224c1 } deploymentID: ce48e2e4-155f-5b76-8a41-cbae3ba1ae0f eventID: cb981a04-1079-31a9-edd6-85597d7fb99f experienceID: 32080c9e-d599-ba82-ad93-1ee099c04fdf optInRequired: 3 timestamp: 1658186091 userID: 4e0b955955b5623d11236342c14ae1cdf6dd7b59f1ddc4e65dda002ebd22e6fd version: 4 visibility: anonymous,support |
app.session.MissionControl.previewClick |
Tracking how users are using the Preview feature in Incident Review. | component: app.session.MissionControl.previewClick data: { [-] action: previewIncident.click app: missioncontrol incidentId: 80391c34-c26e-45ef-b47d-6966b8e52539 page: mc_incident_review pathname: /en-US/app/missioncontrol/mc_incident_review sessionID: 967af740-baa1-4348-be94-012b70b1d8d4 } deploymentID: ce48e2e4-155f-5b76-8a41-cbae3ba1ae0f eventID: c60cc63b-eaeb-4422-e4ea-61fd5c08c17a experienceID: 6409f66e-a7a9-168f-85f3-ecc8fe8d009b optInRequired: 3 timestamp: 1658183313 userID: 4e0b955955b5623d11236342c14ae1cdf6dd7b59f1ddc4e65dda002ebd22e6fd version: 4 visibility: anonymous,support |
app.session.MissionControl.sortClick |
Tracking how users are sorting the table of Incidents in Incident Review. | component: app.session.MissionControl.sortClick data: { [-] action: sortIncidentReviewTable.click app: missioncontrol field: update_time order: asc page: mc_incident_review pathname: /en-US/app/missioncontrol/mc_incident_review sessionID: c1900ee7-3413-410f-a415-f68e71a098dc } deploymentID: ce48e2e4-155f-5b76-8a41-cbae3ba1ae0f eventID: da35cefa-a455-43b3-f302-009b610a2d96 experienceID: 189df09f-6e4b-4378-91eb-222a6b43e387 optInRequired: 3 timestamp: 1658179213 userID: 4e0b955955b5623d11236342c14ae1cdf6dd7b59f1ddc4e65dda002ebd22e6fd version: 4 visibility: anonymous,support |
app.session.MissionControl.responsePlanTaskEnded |
Tracking whenever response plan tasks are completed by a user. | app: splunk_instrumentation component: app.session.MissionControl.responsePlanTaskEnded data: { [-] action: taskStatus.ended app: missioncontrol incidentId: f5aa0b6a-3ce3-4c74-9177-6de9033c3d6d page: mc_incident_review pathname: /en-US/app/missioncontrol/mc_incident_review planId: cbba8ce9-a37a-4922-bc02-c901481fc29b sessionID: f10d73be-a333-4e9a-b1be-57957fbba7cb taskId: bc2a52f7-e0d3-4203-bcbe-80df22031207 } datetime: 07-18-2022 22:41:46.889 +0000 deploymentID: CLOUD-a3298e8a-4ab4-53a0-88ab-01870a1797a4 environment: stg eventID: 8F621DFE-4BB9-4D62-A22A-E11D9F7D4712 executionID: 93E6EB60-DDE7-4032-882F-6AD68CFAC0B7 experienceID: d1cb88b3-eb72-fdb9-3c90-d0eb849b595d optInRequired: 3 stackID: 5f078bb7147e221aebe8e093aecab8bbe672753cedbd124f3e85d57a612a90df timestamp: 1658183567 type: event userID: 108c7b6692d0cebb61dbcc4197f4c054e920a8895148c6a99a96b25a925a1e18 visibility: anonymous |
app.MissionControl.CustomField_Create |
Count of custom fields created. | { [-] app: missioncontrol component: app.MissionControl.CustomField_Create data: { [-] customfield_count: 1 } datetime: 10-21-2022 23:49:39.933 +0000 deploymentID: CLOUD-ce4f0656cd7c7cdd704382e85fe70f2e8d41c1231aa081af74db075bcf91492c environment: stg eventID: 0DD12999-3DB2-4940-B7DB-B63F99355028 executionID: 87B93925-7E7D-4FD9-A28E-2CCD2D52722F optInRequired: 3 stackID: ce4f0656cd7c7cdd704382e85fe70f2e8d41c1231aa081af74db075bcf91492c timestamp: 1666396175 type: event userID: 1322faf308e988b9c4bbb7d0658eb1a92e96b10f48b7728e40840181f3149587 visibility: anonymous,support } |
app.MissionControl.Event_List |
Statistics about the amount and duration of searches when listing events. | { [-] app: missioncontrol component: app.MissionControl.Event_List data: { [-] search_count: 1 search_job_elapsed_time: 1666222229 } datetime: 10-19-2022 23:39:12.566 +0000 deploymentID: CLOUD-9437d510aabac6b49866573de6a838fd4a5b3f5a67fea20e11ac46de9c33b6b2 environment: stg eventID: 9563EB2E-5DE9-4D37-968A-0CA7E630EA40 executionID: 24D2F783-2777-4FDC-8467-1A1567958D1B optInRequired: 3 stackID: 9437d510aabac6b49866573de6a838fd4a5b3f5a67fea20e11ac46de9c33b6b2 timestamp: 1666222234 type: event userID: d220d7796e330cb5f52fdecaaa840512f51a4c924318ac3536a4ff37a235452b visibility: anonymous,support } |
app.session.rum.mark |
UI performance metrics. | { app: splunk_instrumentation component: app.session.rum.mark data: { [-] aggregatedTimings: { [-] appserver: { [-] dns: 0 load: 0.5 processing: 3622.399999976158 redirect: 0 request: 851.5 response: 4.199999988079071 tcp: 0 totalRequests: 5 } other: { [-] dns: 0 load: 0 processing: 0 redirect: 0 request: 0 response: 5180.199999988079 tcp: 0 totalRequests: 1 } splunkd: { [-] dns: 0 load: 0 processing: 0 redirect: 0 request: 5019.4000000059605 response: 673.5999999642372 tcp: 0 totalRequests: 36 } static-asset: { [-] dns: 0 load: 0 processing: 0 redirect: 0 request: 2214.800000011921 response: 3604.4999999403954 tcp: 82.90000000596046 totalRequests: 19 } } app: missioncontrol context: { [-] } firstContentfulPaint: 3259.5999999940395 firstPaint: 847.9000000059605 hero: IncidentReview-TimeToInteractive navigationTimings: { [-] dns: 0 load: 0.5 processing: 3622.399999976158 redirect: 0 request: 316.40000000596046 requestType: appserver response: 0.7999999821186066 tcp: 0 } page: mc_incident_review sourceLocation: IncidentListMounted timeSinceOrigin: 5356.299999982119 transactionId: cdb0a550-a33a-11ed-8089-556e41c09736 } datetime: 02-02-2023 20:53:27.710 +0000 deploymentID: CLOUD-5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250 environment: stg eventID: 3EC8DAC5-25CD-49C6-B339-F45F03DF63EA executionID: 4429B60C-4B5F-43DB-A035-FFFB58E673BE experienceID: 92d8db2e-f7a4-7a59-002f-4e93618d675f optInRequired: 3 stackID: 5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250 timestamp: 1675370848 type: event userID: c25a863e6f07498b1e1a7e1f5c3d4ebc32669307dcb9138d4852eb5df2b7f4b7 visibility: anonymous,support } |
app.session.rum.measure |
UI performance metrics. | { [-] app: splunk_instrumentation component: app.session.rum.measure data: { [-] app: missioncontrol context: { [-] } duration: 7134.9000000059605 fromSourceDurations: { [-] IncidentListMounted: 5865.800000011921 IncidentReview-TimeToInteractive: 0 } fromSourceLocation: origin hero: IncidentReview-TimeToInteractive page: mc_incident_review timeSinceOrigin: 7134.9000000059605 toSourceLocation: IncidentReview-TimeToInteractive transactionId: 425f8e70-a33b-11ed-bb34-4f3de3099440 } datetime: 02-02-2023 20:53:27.708 +0000 deploymentID: CLOUD-5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250 environment: stg eventID: A4E24B3A-3CB4-4003-B9D3-A7C743AB2650 executionID: 4429B60C-4B5F-43DB-A035-FFFB58E673BE experienceID: 92d8db2e-f7a4-7a59-002f-4e93618d675f optInRequired: 3 stackID: 5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250 timestamp: 1675371049 type: event userID: c25a863e6f07498b1e1a7e1f5c3d4ebc32669307dcb9138d4852eb5df2b7f4b7 visibility: anonymous,support } |
app.session.MissionControl.responsePlanSoarAutomationClicked |
Type of automation executed in response plan. | { app: splunk_instrumentation component: app.session.MissionControl.responsePlanSoarAutomationClicked data: { [-] app: missioncontrol incidentId: 85119140-8f70-4442-b2c9-6f97a9d43a15 page: mc_incident_review pathname: /en-US/app/missioncontrol/mc_incident_review phaseId: 4e5ac75f-6570-42bb-ab98-0a69363e5a8e sessionID: 17eb54e3-d007-48ac-8e75-0d4e7bc6d57b taskId: a3d372fa-c08c-43cf-b043-cd1d9bf55e9c type: action } datetime: 01-18-2023 00:33:30.240 +0000 deploymentID: CLOUD-c1f24f272b6470307e036645664e808da01067974ba94b8c0500b7e93b4a2bba environment: stg eventID: 55D8C86A-1204-4CA1-9484-DFFD90A018F2 executionID: 04D37357-D55F-4508-9CB0-85285154ACF9 experienceID: 9c06a211-3333-d7fa-c7c9-bec30487fd49 optInRequired: 3 stackID: c1f24f272b6470307e036645664e808da01067974ba94b8c0500b7e93b4a2bba timestamp: 1674001689 type: event userID: fde510d805fa7761ce2a5cfb1c8c3df7feafc5efc76b4a6eac9c42c2fbc1527a visibility: anonymous,support } { app: splunk_instrumentation component: app.session.MissionControl.responsePlanSoarAutomationClicked data: { [-] app: missioncontrol incidentId: 85119140-8f70-4442-b2c9-6f97a9d43a15 page: mc_incident_review pathname: /en-US/app/missioncontrol/mc_incident_review phaseId: 4e5ac75f-6570-42bb-ab98-0a69363e5a8e sessionID: 17eb54e3-d007-48ac-8e75-0d4e7bc6d57b taskId: a3d372fa-c08c-43cf-b043-cd1d9bf55e9c type: playbook } datetime: 01-18-2023 00:33:30.239 +0000 deploymentID: CLOUD-c1f24f272b6470307e036645664e808da01067974ba94b8c0500b7e93b4a2bba environment: stg eventID: B76AD1CA-E2AB-475C-850E-62CA43514871 executionID: 04D37357-D55F-4508-9CB0-85285154ACF9 experienceID: 9c06a211-3333-d7fa-c7c9-bec30487fd49 optInRequired: 3 stackID: c1f24f272b6470307e036645664e808da01067974ba94b8c0500b7e93b4a2bba timestamp: 1674001741 type: event userID: fde510d805fa7761ce2a5cfb1c8c3df7feafc5efc76b4a6eac9c42c2fbc1527a visibility: anonymous,support } |
app.MissionControl.Create_Event |
Count of events created. | { [-] app: missioncontrol component: app.MissionControl.Event_Create data: { [-] event_count: 1 } datetime: 02-07-2023 04:58:43.879 +0000 deploymentID: CLOUD-cdfed0ab-9747-565c-a1d4-8528229c12fd environment: stg eventID: 98EFFB40-FE33-4832-BACC-BA5C4EA55C55 executionID: F5DB7E28-4058-4FAC-9547-9C77B6D1466D optInRequired: 3 stackID: 42f14a7e5f105d309cd5f2d25c2f7be636528f650c98a6cf6d912865dafe799d timestamp: 1675745811 type: event userID: 4cf0aa1fb38229445505da09968087abab3b97f210b9254ae527f907a0d2e3b9 visibility: anonymous } |
app.MissionControl.Delete_Event |
Count of events deleted. | { [-] app: missioncontrol component: app.MissionControl.Event_Delete data: { [-] event_count: -1 } datetime: 02-07-2023 20:11:17.700 +0000 deploymentID: CLOUD-5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250 environment: stg eventID: 6C33A16E-39C0-48E7-B7E2-3201B1BC8D8A executionID: D16CC7B3-20F5-409A-8F19-CEA2382EB1EF optInRequired: 3 stackID: 5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250 timestamp: 1675800526 type: event userID: c25a863e6f07498b1e1a7e1f5c3d4ebc32669307dcb9138d4852eb5df2b7f4b7 visibility: anonymous,support } |
app.MissionControl.fileUploadedIncident |
File name and size. | app: missioncontrol component: app.MissionControl.fileUploadedIncident data: { [-] size: 1024 } datetime: 07-17-2022 04:27:20.126 +0000 deploymentID: CLOUD-2cc191a3-94a8-54a0-b390-63b5665fad35 environment: stg eventID: 6FDC1B28-9B83-4C7D-A1D6-E9373ECF196A executionID: 34ABCD8B-7F61-46F1-966F-6ACFA6FD5F90 optInRequired: 3 stackID: ac88a9ea1646570463f40ec2e929581bfc3fae4380d1d936c0346a292ac8a25b timestamp: 1658032031 type: aggregate visibility: anonymous |
app.MissionControl.fileUploadedTask |
File name and size. | app: missioncontrol component: app.MissionControl.fileUploadedTask data: { [-] size: 1024 } datetime: 07-17-2022 04:27:20.126 +0000 deploymentID: CLOUD-2cc191a3-94a8-54a0-b390-63b5665fad35 environment: stg eventID: 6FDC1B28-9B83-4C7D-A1D6-E9373ECF196A executionID: 34ABCD8B-7F61-46F1-966F-6ACFA6FD5F90 optInRequired: 3 stackID: ac88a9ea1646570463f40ec2e929581bfc3fae4380d1d936c0346a292ac8a25b timestamp: 1658032031 type: aggregate visibility: anonymous |
app.MissionControl.fileDownloaded |
File name and size. | app: missioncontrol component: app.MissionControl.fileDownloaded data: { [-] size: 1024 } datetime: 07-17-2022 04:27:20.126 +0000 deploymentID: CLOUD-2cc191a3-94a8-54a0-b390-63b5665fad35 environment: stg eventID: 6FDC1B28-9B83-4C7D-A1D6-E9373ECF196A executionID: 34ABCD8B-7F61-46F1-966F-6ACFA6FD5F90 optInRequired: 3 stackID: ac88a9ea1646570463f40ec2e929581bfc3fae4380d1d936c0346a292ac8a25b timestamp: 1658032031 type: aggregate visibility: anonymous |
app.session.MissionControl.splPreviewSuccess |
Metadata about successful SPL Preview results triggered by the UI to power features in the app. | component: app.session.MissionControl.splPreviewSuccess data: { [-] action: searchResultsPreview.load app: missioncontrol executionTime: 4275.5 page: mc_incident_review pathname: /en-US/app/missioncontrol/mc_incident_review searchMacro: | `mc_incidents` sessionID: e16ae6b4-e407-4238-8bcb-a08aa05232ab } deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb eventID: 23792757-d7b1-0bf3-3329-68383fc0675f experienceID: f4c99b71-d781-9569-3eb4-a2306cde9a7c optInRequired: 3 splunkVersion: 9.0.0 timestamp: 1658189286 userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33 version: 4 visibility: anonymous,support |
app.session.MissionControl.splPreviewError |
Metadata about errors when making Preview call for SPL queries from the UI. | component: app.session.MissionControl.splPreviewError data: { [-] action: searchResults.error app: missioncontrol executionTime: 34.39999997615814 page: mc_incident_review pathname: /en-US/app/missioncontrol/mc_incident_review searchMacro: | `mc_incidents` sessionID: b55ed6e3-e92d-4336-b074-54fe5f45987b } deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb eventID: b63f483f-fea3-3e23-b6b3-e7600b01ac9c experienceID: b26453d2-6630-784f-3624-98360be1e98e optInRequired: 3 splunkVersion: 9.0.0 timestamp: 1658188621 userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33 version: 4 visibility: anonymous,support |
app.session.rum.mark |
How much time does it take to render the AQ table with preview results. | { app: splunk_instrumentation component: app.session.rum.mark data: { [-] aggregatedTimings: { [-] appserver: { [-] dns: 0 load: 0.5 processing: 3622.399999976158 redirect: 0 request: 851.5 response: 4.199999988079071 tcp: 0 totalRequests: 5 } other: { [-] dns: 0 load: 0 processing: 0 redirect: 0 request: 0 response: 5180.199999988079 tcp: 0 totalRequests: 1 } splunkd: { [-] dns: 0 load: 0 processing: 0 redirect: 0 request: 5019.4000000059605 response: 673.5999999642372 tcp: 0 totalRequests: 36 } static-asset: { [-] dns: 0 load: 0 processing: 0 redirect: 0 request: 2214.800000011921 response: 3604.4999999403954 tcp: 82.90000000596046 totalRequests: 19 } } app: missioncontrol context: { [-] } firstContentfulPaint: 3259.5999999940395 firstPaint: 847.9000000059605 hero: IncidentReview-TimeToInteractive navigationTimings: { [-] dns: 0 load: 0.5 processing: 3622.399999976158 redirect: 0 request: 316.40000000596046 requestType: appserver response: 0.7999999821186066 tcp: 0 } page: mc_incident_review sourceLocation: IncidentListFirstResults timeSinceOrigin: 5356.299999982119 transactionId: cdb0a550-a33a-11ed-8089-556e41c09736 } datetime: 02-02-2023 20:53:27.710 +0000 deploymentID: CLOUD-5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250 environment: stg eventID: 3EC8DAC5-25CD-49C6-B339-F45F03DF63EA executionID: 4429B60C-4B5F-43DB-A035-FFFB58E673BE experienceID: 92d8db2e-f7a4-7a59-002f-4e93618d675f optInRequired: 3 stackID: 5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250 timestamp: 1675370848 type: event userID: c25a863e6f07498b1e1a7e1f5c3d4ebc32669307dcb9138d4852eb5df2b7f4b7 visibility: anonymous,support } |
mc_get_observable_objects_command.log |
Logs from the custom search command. | {"location": "splunk_search.py:41", "time": "2023-04-23T13:27:49Z", "filename": "splunk_search.py", "hostname": "C02G238WMD6R", "service": null, "message": "Creating search job", "level": "INFO", "metadata": {"sid": "1682256464.16"}} {"location": "splunk_search.py:51", "time": "2023-04-23T13:27:49Z", "filename": "splunk_search.py", "hostname": "C02G238WMD6R", "service": null, "message": "Search Job: sid=1682256469.19", "level": "INFO", "metadata": {"sid": "1682256464.16"}} {"location": "splunk_search.py:122", "time": "2023-04-23T13:27:54Z", "filename": "splunk_search.py", "hostname": "C02G238WMD6R", "service": null, "message": "Waiting for search to complete. dispatchState=PARSING", "level": "INFO", "metadata": {"sid": "1682256464.16"}} {"location": "splunk_search.py:97", "time": "2023-04-23T13:27:54Z", "filename": "splunk_search.py", "hostname": "C02G238WMD6R", "service": null, "message": "Completed running search. Getting results.", "level": "INFO", "metadata": {"sid": "1682256464.16"}} |
app.session.MissionControl.responseTemplateCreated |
Name of the hashed response name and its status. | component: app.session.MissionControl.responseTemplateCreated data: { [-] app: missioncontrol name: 7eg860c3247cc8a00e7eb6783bc827be5ffc89e6abd721a6831c8903a9363f25 status: draft page: mc_content pathname: /en-US/app/missioncontrol/mc_content sessionID: b55ed6e3-e92d-4336-b074-54fe5f45987b } deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb eventID: b63f483f-fea3-3e23-b6b3-e7600b01ac9c experienceID: b26453d2-6630-784f-3624-98360be1e98e optInRequired: 3 splunkVersion: 9.0.0 timestamp: 1658188621 userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33 version: 4 visibility: anonymous,support |
app.session.MissionControl.responseTemplateUpdated |
Name of the hashed response name and its status. | component: app.session.MissionControl.responseTemplateUpdated data: { [-] app: missioncontrol name: 7eg860c3247cc8a00e7eb6783bc827be5ffc89e6abd721a6831c8903a9363f25 status: draft page: mc_content pathname: /en-US/app/missioncontrol/mc_content sessionID: b55ed6e3-e92d-4336-b074-54fe5f45987b } deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb eventID: b63f483f-fea3-3e23-b6b3-e7600b01ac9c experienceID: b26453d2-6630-784f-3624-98360be1e98e optInRequired: 3 splunkVersion: 9.0.0 timestamp: 1658188621 userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33 version: 4 visibility: anonymous,support |
app.session.MissionControl.responseTemplateAppliedManually |
Incident id and the number of templates applied. | component: app.session.MissionControl.responseTemplateAppliedManually data: { [-] app: missioncontrol incidentId: 7eg860c3247cc8a00e7eb6783bc827be5ffc89e6abd721a6831c8903a9363f25 count: 3 page: mc_incident_review pathname: /en-US/app/missioncontrol/mc_incident_review sessionID: b55ed6e3-e92d-4336-b074-54fe5f45987b } deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb eventID: b63f483f-fea3-3e23-b6b3-e7600b01ac9c experienceID: b26453d2-6630-784f-3624-98360be1e98e optInRequired: 3 splunkVersion: 9.0.0 timestamp: 1658188621 userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33 version: 4 visibility: anonymous,support |
app.session.MissionControl.responseTemplateAppliedByType |
Incident type and the number of templates applied. | component: app.session.MissionControl.responseTemplateAppliedByType data: { [-] app: missioncontrol incidentType: test count: 5 page: mc_settings pathname: /en-US/app/missioncontrol/mc_settings sessionID: b55ed6e3-e92d-4336-b074-54fe5f45987b } deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb eventID: b63f483f-fea3-3e23-b6b3-e7600b01ac9c experienceID: b26453d2-6630-784f-3624-98360be1e98e optInRequired: 3 splunkVersion: 9.0.0 timestamp: 1658188621 userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33 version: 4 visibility: anonymous,support |
app.session.MissionControl.manualIncidentCreated |
Incident type. | component: app.session.MissionControl.manualIncidentCreated data: { [-] incident_type: test } deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb eventID: b63f483f-fea3-3e23-b6b3-e7600b01ac9c experienceID: b26453d2-6630-784f-3624-98360be1e98e optInRequired: 3 splunkVersion: 9.0.0 timestamp: 1658188621 userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33 version: 4 visibility: anonymous,support |
app.session.MissionControl.soarProvisioning |
UI telemetry related to SOAR provisioning and de-provisioning |
app: splunk_instrumentation component: app.session.MissionControl.soarProvisioning data: { [-] action: soarTrialInformationModal.open app: missioncontrol page: mc_incident_review pathname: /en-US/app/missioncontrol/mc_incident_review sessionID: beb760f5-553e-4e0c-b3c9-e19c79375ac5 } datetime: 06-28-2023 19:47:12.999 +0000 deploymentID: CLOUD-5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250 environment: stg eventID: CAFA41AA-C7FC-4CA9-9CD6-AF40ED24A007 executionID: 75812D8A-6B93-4598-99E2-9A6ADA5941FE experienceID: 331dfd32-d8a8-2193-e830-29dcaea81bdf optInRequired: 3 stackID: 5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250 timestamp: 1687980731 type: event userID: 37a44c7717e338af39ec632ac18ae89dc778b7e72f67aa5361f9cea381d570c8 visibility: anonymous,support |
app.MissionControl.Event_Add |
BE telemetry related to artifact extraction. Triggered by an instance of events being added to an incident. | { "type": "event", "component": "app.MissionControl.Event_Add", "optInRequired": 3, "data": {"artifact_count": 4}, } |
app.MissionControl.Event_Create |
BE telemetry related to artifact extraction. Triggered by an instance of events being created. | { "type": "event", "component": "app.MissionControl.Event_Create", "optInRequired": 3, "data": {"artifact_count": 4}, } |
app.MissionControl.Event_Update |
BE telemetry related to artifact extraction. Triggered by an event being updated. | { "type": "event", "component": "app.MissionControl.Event_Update", "optInRequired": 3, "data": {"artifact_count": 4}, } |
app.MissionControl.New_Parent_Child_Incident_Relationship |
BE telemetry related to parent and child incident relationship. Triggered when a parent incident with no current children, adds a child incident or incidents. | { [-] app: missioncontrol component: app.MissionControl.New_Parent_Child_Incident_Relationship data: { [-] incident_count: 1 } datetime: 08-15-2023 20:08:24.696 +0000 deploymentID: CLOUD-31fdbb8432b1089489ed46906f0574a4e9e87af758eb485a5c68501b55aab2ab environment: stg eventID: E568971C-202F-4A4C-8F66-68D411101E95 executionID: 0B01BAC4-5539-4F18-A1A7-3CE29FB84CBC optInRequired: 3 stackID: 31fdbb8432b1089489ed46906f0574a4e9e87af758eb485a5c68501b55aab2ab timestamp: 1692129643 type: event userID: 8465834b65d1f3593d2b885de0b1788074fad108e2db680d0e8fd41b2d765736 visibility: anonymous,support } |
app.MissionControl.Added_Children_Incidents |
BE telemetry related to parent and child incident relationship. Triggered when a parent incident adds a child incident or incidents. | { [-] app: missioncontrol component: app.MissionControl.Added_Children_Incidents data: { [-] children_incident_count: 6 incident_count: 1 } datetime: 08-15-2023 20:08:24.696 +0000 deploymentID: CLOUD-31fdbb8432b1089489ed46906f0574a4e9e87af758eb485a5c68501b55aab2ab environment: stg eventID: 12B480DA-079B-43AC-9E8E-AAE2B11B5BBD executionID: 0B01BAC4-5539-4F18-A1A7-3CE29FB84CBC optInRequired: 3 stackID: 31fdbb8432b1089489ed46906f0574a4e9e87af758eb485a5c68501b55aab2ab timestamp: 1692129643 type: event userID: 8465834b65d1f3593d2b885de0b1788074fad108e2db680d0e8fd41b2d765736 visibility: anonymous,support } |
app.session.MissionControl.soarProvisioning (updated) |
UI telemetry related to SOAR provisioning and de-provisioning. Triggered by: opening soar trial info modal, exporting usage report PDF, API or SPL query requests on the modal failing. | app: splunk_instrumentation component: app.session.MissionControl.soarProvisioning data: { [-] action: soarTrialInformationModal.apiFailed endpoint: fetchTopPlaybook statusCode: 401 err: example_error app: missioncontrol page: mc_incident_review pathname: /en-US/app/missioncontrol/mc_incident_review sessionID: beb760f5-553e-4e0c-b3c9-e19c79375ac5 } datetime: 06-28-2023 19:47:12.999 +0000 deploymentID: CLOUD-5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250 environment: stg eventID: CAFA41AA-C7FC-4CA9-9CD6-AF40ED24A007 executionID: 75812D8A-6B93-4598-99E2-9A6ADA5941FE experienceID: 331dfd32-d8a8-2193-e830-29dcaea81bdf optInRequired: 3 stackID: 5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250 timestamp: 1687980731 type: event userID: 37a44c7717e338af39ec632ac18ae89dc778b7e72f67aa5361f9cea381d570c8 visibility: anonymous,support |
app.session.MissionControl.riskEventTimelineViewed |
This UI telemetry collects the risk event data of the incident. The risk event data includes the number of events, type of the events and the total risk score. | { "component": "app.session.MissionControl.riskEventTimelineViewed", "data": { "incidentId": "6496f9ad-ce1f-4864-9aa4-8095d7aeb4b1", "eventCount": 100, "eventType": "user", "score": "6512.0", "pathname": "/en-US/app/missioncontrol/mc_incident_review", "sessionID": "99412f67-4bd1-407f-a6d7-c6e9ca05f8ad", "app": "missioncontrol", "page": "mc_incident_review" }, "timestamp": 1695664524, "visibility": [ "anonymous", "support" ], "experienceID": "91c0a41e-d8b7-7adb-3058-b587896ba6fa", "deploymentID": "CLOUD-b08dc8b01ce7ac7d132b0e2406e4f45bf7134152315d732e5c8537c9f5793e0b", "userID": "1b599e8c8a86f88792ecf11be4145a9ef43b623f6451824bd630fadf63014a4b", "eventID": "b8e3db7c-7be1-bc3a-4d15-276ebf6ae6a2", "splunkVersion": "9.0.2209.4", "optInRequired": 3, "type": "event" } |
app.session.MissionControl.parentChildDropdownSelected |
UI telemetry relating to parent and child incident relationships. This is collected when the user selects an option in the parent child dropdown of any section to view parent data, child data, or aggregate data. | { "component": "app.session.MissionControl.parentChildDropdownSelected", "data": { "dropdown": "summary", "view": "Parent incident", "incidentId": "48058722-2460-4ca7-915b-1600a83f416c", "pathname": "/en-US/app/missioncontrol/mc_incident_review", "sessionID": "f8944054-fb4f-4930-b058-1170953a0390", "app": "missioncontrol", "page": "mc_incident_review" }, "timestamp": 1696021630, "visibility": [ "anonymous", "support" ], "experienceID": "77c39d6d-ac42-dbf6-0993-162c237aab27", "deploymentID": "CLOUD-5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250", "userID": "d2eef8e82a3b6b27ed917529f98f5fae14dbc1591a95aebf3c53c5796d159738", "eventID": "6987c0e4-fd29-5f3b-5c7e-ef1f9890e8cb", "splunkVersion": "9.0.2303.202", "optInRequired": 3, "type": "event" } |
app.session.MissionControl.splDelayWarning |
This UI telemetry keeps track a rare race condition where the return of the incident data by SPL is slower than the one by REST API. | { "component": "app.session.MissionControl.splDelayWaring", "data": { "incidentId": "6496f9ad-ce1f-4864-9aa4-8095d7aeb4b1", "pathname": "/en-US/app/missioncontrol/mc_incident_review", "sessionID": "99412f67-4bd1-407f-a6d7-c6e9ca05f8ad", "app": "missioncontrol", "page": "mc_incident_review" }, "timestamp": 1695664524, "visibility": [ "anonymous", "support" ], "experienceID": "91c0a41e-d8b7-7adb-3058-b587896ba6fa", "deploymentID": "CLOUD-b08dc8b01ce7ac7d132b0e2406e4f45bf7134152315d732e5c8537c9f5793e0b", "userID": "1b599e8c8a86f88792ecf11be4145a9ef43b623f6451824bd630fadf63014a4b", "eventID": "b8e3db7c-7be1-bc3a-4d15-276ebf6ae6a2", "splunkVersion": "9.0.2209.4", "optInRequired": 3, "type": "event" } |
Migrating Splunk Mission Control incident data to Splunk Enterprise Security 8.0 |
This documentation applies to the following versions of Splunk® Mission Control: Current
Feedback submitted, thanks!