topic Re: How to load data into the Splunk App for Enterprise Security? in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-load-data-into-the-Splunk-App-for-Enterprise-Security/m-p/180639#M827 <P>As a general statement, all data in Splunk that you want to use in ES needs to be CIM compliant. These means that the TA's used to parse events, extract and alias fields, all need to have CIM compliant mappings.</P> <P>@ekost's link is a good starting point, along with : <A href="http://docs.splunk.com/Documentation/CIM/4.2.0/User/Overview">http://docs.splunk.com/Documentation/CIM/4.2.0/User/Overview</A></P> Thu, 20 Aug 2015 15:29:13 GMT esix_splunk 2015-08-20T15:29:13Z How to load data into the Splunk App for Enterprise Security? https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-load-data-into-the-Splunk-App-for-Enterprise-Security/m-p/180637#M825 <P>What is the procedure to load the data into the Splunk App for Enterprise Security?</P> Wed, 19 Aug 2015 07:50:10 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-load-data-into-the-Splunk-App-for-Enterprise-Security/m-p/180637#M825 geosujith 2015-08-19T07:50:10Z Re: How to load data into the Splunk App for Enterprise Security? https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-load-data-into-the-Splunk-App-for-Enterprise-Security/m-p/180638#M826 <P>You'll find a page in the docs <A href="http://docs.splunk.com/Documentation/ES/3.3.1/Install/Planyourdatainputs">here</A> that discusses data onboarding for ES.</P> Thu, 20 Aug 2015 15:18:49 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-load-data-into-the-Splunk-App-for-Enterprise-Security/m-p/180638#M826 ekost 2015-08-20T15:18:49Z Re: How to load data into the Splunk App for Enterprise Security? https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-load-data-into-the-Splunk-App-for-Enterprise-Security/m-p/180639#M827 <P>As a general statement, all data in Splunk that you want to use in ES needs to be CIM compliant. These means that the TA's used to parse events, extract and alias fields, all need to have CIM compliant mappings.</P> <P>@ekost's link is a good starting point, along with : <A href="http://docs.splunk.com/Documentation/CIM/4.2.0/User/Overview">http://docs.splunk.com/Documentation/CIM/4.2.0/User/Overview</A></P> Thu, 20 Aug 2015 15:29:13 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-load-data-into-the-Splunk-App-for-Enterprise-Security/m-p/180639#M827 esix_splunk 2015-08-20T15:29:13Z