Feeds (DataSource - splk-dsm) - Docs notes & links

Introduction to documentation notes & links for splk-dsm

Documentation notes & links

The documentation notes for splk-dsm is a simple feature which allows to provide easy to access documentation context directly in the TrackMe UI.
This feature is only available for the Data Source tracking component. (splk-dsm)
You can define global and default documentation notes and links, which apply for every entity in TrackMe.
In Addition, you can also define documentation notes and links for each entity separately or linked to multiple entities.
If both global documentation notes and entity specific documentation notes are defined, the entity specific documentation notes will be used.

Where to find the documentation notes & links in TrackMe UI

When you open the screen of a a specific entity, TrackMe shows as the top of the screen a link referring to documentation notes & link, depending on if a documentations notes have been defined yet: (global or per entity)

No documentation notes defined yet

Documentation notes defined

If documentation notes are defined, the content would appear as:

If documentation notes are not defined yet, the following screen shows up and allows to create a new documentation reference, or link to an existing documentation reference:

Defining global documentation notes & links

To define global documentation notes & links, you need to navigate to the “Configure” screen and select the “splk-general” tab:

Example:

Note that the documentation notes & links defined globally can be overridden on per entity basis, so you can still reference specific documentation notes & links for each entity.

Before TrackMe 2.0.87

Before this release of TrackMe, the global configuration was made in several Splunk macros (trackme_identity_card_default_url, trackme_identity_card_default_note)
If you were using this feature before this version, please backport your configuration to the new global configuration screen.

Defining documentation notes & links per entity

If a global documentation reference is defined, TrackMe shows an informational message and allows defining an entity specific documentation reference, or link to an existing one:

If a specific entity note was defined however, the screen will allow deleting or updating this reference:

REST API endpoints

Identity cards are managed via read only and write REST API endpoints, consult the REST API Dashboard in TrackMe for the detailed usage and example:

API resource groups:

splk_identity_cards: read only endpoints (trackmeuseroperations capability)
splk_identity_cards/write: write endpoints (trackmepoweroperations capability)

KVstore collections

TrackMe stores the documentation notes & links in the following KVstore collections:

trackme_dsm_knowledge_tenant_<tenant_id>

For example:

| inputlookup trackme_dsm_knowledge_tenant_mytenant | eval key=_key

Fields:

_key: The record id
doc_link: The documentation link
doc_note: The documentation note
object: A multi-value (in Python this is a list) field containing the list of entities this documentation note is linked to