topic Re: Logs in Splunk Search

Logs

SN1 — Wed, 22 Jan 2025 07:07:29 GMT

i want to know in which index is microsoft defender logs getting stored , I know some important fields which are there in microsoft defender and now i want to find them whether they are getting stored or not .

Re: Logs

isoutamo — Wed, 22 Jan 2025 07:33:44 GMT

those are always your organization's decisions. Usually there be some naming standards which define those index names. Best option is to ask it from your Splunk admin or look your internal documentation.

One option is try

| metadata type=hosts index=*

which shows what hosts has sent events to indexes on your selected time slot.

r. Ismo

Re: Logs

gcusello — Wed, 22 Jan 2025 07:51:19 GMT

Hi @SN1 ,

as @isoutamo said, index is defined in the used Add-on.

Anyway, Splunk isn't a database, so the field definition is indipendent from the index where logs are stored and you can see the fields wherever they are stored.

If you don't see the fields, see the add-on you used.

Ciao.

Giuseppe