topic Re: Log indexing in to splunk in Getting Data In

Log indexing in to splunk

AL3Z — Mon, 20 Nov 2023 07:22:36 GMT

Hi,

I'm curious to know when the logs will be indexed after the incident triggered in Splunk.

Thanks

Re: Log indexing in to splunk

gcusello — Mon, 20 Nov 2023 07:58:04 GMT

Hi @AL3Z ,

could you better describe your question?

logs are indexed when they arrive in Splunk.

Are you speaking of Splunk Enterprise or Enterprise Security?

Anyway, when an alert is triggered the alert is written in an indexor in the triggered alerts list or in a lookup depending on the action the you defined for that alert.

Ciao.

Giuseppe

Re: Log indexing in to splunk

AL3Z — Mon, 20 Nov 2023 08:05:32 GMT

Hi @gcusello ,

When do logs arrive in Splunk after a user has performed an activity

Re: Log indexing in to splunk

gcusello — Mon, 20 Nov 2023 14:31:00 GMT

Hi @AL3Z,

sorry but I continue to not understand: are you speaking of an activiy on Splunk or on a target system?

if on Splunk, it depends on the action that you associated to the alert(you can create a Noteble, send an eMail, write in an index or i a lookup, etc...)

if on the target system, it depends on how you ingest logs from the target system.

Ciao.

Giuseppe