topic Re: WSOC App with more than one index in All Apps and Add-ons

WSOC App with more than one index

hartfoml — Mon, 17 Sep 2012 14:55:15 GMT

I want to use the Windows Security Operations Center (WSOC) app but My win. event logs or fragmented in many indexes. I use different indexes to keep track of different business segments and each segment keeps there windows events in there own index. I would like to pint the WSOC at all the indexes that have Win event logs. Can I do this with the configuration GUI and how?

Re: WSOC App with more than one index

MarioM — Mon, 17 Sep 2012 19:02:22 GMT

did you try by adding your indexes :

Manager » Access controls » Roles » admin » Indexes searched by default

or using modifying the app WSOC searches and adding a macro

Re: WSOC App with more than one index

hartfoml — Mon, 17 Sep 2012 19:06:42 GMT

yes too many indexes to put in roles and I don't what to have to do this for all groups that need data. Can you point me or get me started on a "MACRO" that would work with this APP?

Re: WSOC App with more than one index

bojanz — Mon, 17 Sep 2012 19:17:47 GMT

The WSOC apps (v1.1) uses macros so you can change this easily.

Go to Manager -> Advanced search -> Search macros

You should see two macros used by the application:

windowsindex and windowssourcetype

Feel free to modify them so they include all your indexes. You can simply enter multiple indexes with the OR keyword in the windowsindex macro, for example:

index=myindex1 OR index=myindex2

This will make Splunk search through both indexes and the whole application should work automatically since all searches use this macro.

Re: WSOC App with more than one index

hartfoml — Mon, 17 Sep 2012 19:20:22 GMT

you are a lifesaver thanks so much this is what I was looking for.

Re: WSOC App with more than one index

sdse78 — Thu, 09 Feb 2017 17:14:08 GMT

What if one wants to search for more than one windowssourcetype?

I tried to do the same as you showed for the indexes and nothing seems to be happening from the change.

I'd like to add Application and System events as well.

Any ideas?