https://community.splunk.com/t5/Splunk-Enterprise-Security/Exposure-Analytics-Manual-Data-Sources/m-p/762332#M12987 <P>If the fields show up in a normal SPL search but fail validation in Exposure Analytics, it's often because EA expects those fields to exist at index time or in a specific data model, not just as search-time extractions. Double-check that your sourcetype mapping and required field names match exactly what EA expects. I don't think there's much official documentation for onboarding custom data sources, so the Splunk docs and community posts are probably your best references unless Splunk Support can share internal guidance.</P> Fri, 17 Jul 2026 22:05:05 GMT henry_collins 2026-07-17T22:05:05Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Exposure-Analytics-Manual-Data-Sources/m-p/762328#M12986 <P>I'm trying to add assets and users from an index that is not apart of the standard predefined sources.&nbsp; &nbsp;I can't&nbsp; seem to get any of the fields to validate.&nbsp; I've updated the props.conf from the exposure analytics app, adding in the stanza for the sourcetype from my data source.&nbsp; In there I've tried a few methods to ensure the field names that i see EA looking for (nt_host, user_id, etc) are parsed out.&nbsp; I verified on a basic SPL search, the field names are parsed and presented at search time.&nbsp; But I can't get any fields to validate.</P><P>&nbsp;</P><P>Is there any documentation that speaks to bringing in your own data into exposure analytics?</P> Fri, 17 Jul 2026 16:22:39 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Exposure-Analytics-Manual-Data-Sources/m-p/762328#M12986 fraserphillips 2026-07-17T16:22:39Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Exposure-Analytics-Manual-Data-Sources/m-p/762332#M12987 <P>If the fields show up in a normal SPL search but fail validation in Exposure Analytics, it's often because EA expects those fields to exist at index time or in a specific data model, not just as search-time extractions. Double-check that your sourcetype mapping and required field names match exactly what EA expects. I don't think there's much official documentation for onboarding custom data sources, so the Splunk docs and community posts are probably your best references unless Splunk Support can share internal guidance.</P> Fri, 17 Jul 2026 22:05:05 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Exposure-Analytics-Manual-Data-Sources/m-p/762332#M12987 henry_collins 2026-07-17T22:05:05Z