Tuning ES to environment

wgawhh5hbnht — Tue, 31 Aug 2021 12:46:09 GMT

How are you tuning ES to your environment?

Are you overwriting the correlation searches that ship with ES or are you making copies of them and modifying the copies?

When there is an update for ES, are you having to go correlation search by correlation search, line by line to comparing them to see what changed?

What about ES Content Updates?

Re: Tuning ES to environment

gcusello — Tue, 31 Aug 2021 14:28:31 GMT

Hi @wgawhh5hbnht,

tuning an ES environment isn't a job to ask in Community but it requires Splunk Professional Services or at least a Training on ES Administration!

Anyway, the most important tuning is to see if there are problems on resources when Scheduled Searches are executed; then you have to see if there are queues in Indexing.

You can check all using the Splunk Monitoring Console.

About the other questions:

make always a copy of Correlation Searches and modify them,
updates in Correlation Searches are always documented in the Release Notes, so you don't need to check them row by row, but you can see the release notes,
ES Content Updates are other Use Cases already available for the users.

Ciao.

Giuseppe

topic Tuning ES to environment in Security

Tuning ES to environment

Re: Tuning ES to environment