Does this SCCM App for Splunk index any data, or is it only used for lookups?

[davebo1896]

Looking to install SCCM App for Splunk. Will this be indexing any data?

If so, how do I estimate how much will be indexed?

[ChrisSummers · Accepted solution]

There are db-tails that get indexed and a few lookups. The app primarily uses the v_GS_Threats, v_StatusMessage, v_gs_installed_software_categorized, v_hs_installed_software, and v_combineddeviceresources views in the SCCM database. You can get an idea of the indexed size by reviewing these. The amount of data added per day will depend on the amount of clients and frequency of your discoveries.