Could you help me with some questions about the Splunk Security Essentials app?

[nilbak1]

I have to install Splunk Security Essentials app in my distributed environment.

I gone through its documentation but I am still having a few queries

1. To activate this, do we need to give access of all index data to a user?
2. Will be there any performance issue since it checks all data ?

[kmorris_splunk · Accepted solution]

1. In order to utilize the searches, your user will need to have access to the indexes that contain the relevant data. Also, if you want to run the data source check, your user will need access to the data sources it is checking for.
2. Any resource usage will only happen when you run the data source check. It is not a continuously running thing.

[nilbak1]

thanks @kmorris for your inputs