All Apps and Add-ons

Is there a list with recommended indexes for Security Essentials?

dersa
Path Finder

Hi, 

is there a list with recommended indexes for Security Essentials? I have to build a PoC in a greenfield deployment and would like to create the indexes in a way that they are also usable in Enterprise Security.

thanks

Alex

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Enterprise Security has a few required indexes, which you can find in the installation instructions.  SSE, however, has neither required nor recommended indexes.  That's because it and ES use *your* indexes where *you* choose to store *your* data in a way that makes the most sense to *you*.  If the data is onboarded in CIM-compliant ways and properly tagged then ES will find it.  In SSE, just edit the searches to use your index names (it's not a Production tool, anyway).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Enterprise Security has a few required indexes, which you can find in the installation instructions.  SSE, however, has neither required nor recommended indexes.  That's because it and ES use *your* indexes where *you* choose to store *your* data in a way that makes the most sense to *you*.  If the data is onboarded in CIM-compliant ways and properly tagged then ES will find it.  In SSE, just edit the searches to use your index names (it's not a Production tool, anyway).

---
If this reply helps you, Karma would be appreciated.

dersa
Path Finder

Thanks Rich!

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...