All Apps and Add-ons

Does this SCCM App for Splunk index any data, or is it only used for lookups?

davebo1896
Communicator

Looking to install SCCM App for Splunk. Will this be indexing any data?

If so, how do I estimate how much will be indexed?

Tags (1)
0 Karma
1 Solution

ChrisSummers
Explorer

There are db-tails that get indexed and a few lookups. The app primarily uses the v_GS_Threats, v_StatusMessage, v_gs_installed_software_categorized, v_hs_installed_software, and v_combineddeviceresources views in the SCCM database. You can get an idea of the indexed size by reviewing these. The amount of data added per day will depend on the amount of clients and frequency of your discoveries.

View solution in original post

ChrisSummers
Explorer

There are db-tails that get indexed and a few lookups. The app primarily uses the v_GS_Threats, v_StatusMessage, v_gs_installed_software_categorized, v_hs_installed_software, and v_combineddeviceresources views in the SCCM database. You can get an idea of the indexed size by reviewing these. The amount of data added per day will depend on the amount of clients and frequency of your discoveries.

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...