All Apps and Add-ons
Highlighted

Does this SCCM App for Splunk index any data, or is it only used for lookups?

Communicator

Looking to install SCCM App for Splunk. Will this be indexing any data?

If so, how do I estimate how much will be indexed?

Tags (1)
0 Karma
Highlighted

Re: Does this SCCM App for Splunk index any data, or is it only used for lookups?

Explorer

There are db-tails that get indexed and a few lookups. The app primarily uses the vGSThreats, vStatusMessage, vgsinstalledsoftwarecategorized, vhsinstalledsoftware, and v_combineddeviceresources views in the SCCM database. You can get an idea of the indexed size by reviewing these. The amount of data added per day will depend on the amount of clients and frequency of your discoveries.

View solution in original post