Getting Data In

Getting new index data into data model

ygoltsev
Engager

Hi - I am trying to configure the authentication data model to include additional source data indexes.

We want to include Duo logs in our dashboard in Splunk ES, but am unsure how to get the data model to recognize the new data.  The logs also appear to be in a different format, but I notice there's a method to "eval" the fields in the data model.  Can you please advise best practice for this? 

Thanks.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The first step is to make sure the Duo logs are CIM-compliant.  Check the manual at https://docs.splunk.com/Documentation/CIM/4.20.0/User/Authentication to see what fields the DM expects.  Add FIELDALIAS and other settings to props.conf to create those fields.  It's not necessary to have all of them, but you'll want to have the fields your ES use cases need.

Once that's done, go to ES's Settings menu and select "CIM Setup".  Add the Duo index to the list of indexes used by the Authentication datamodel and click Save.  Wait for the DM to rebuild and check the results.

---
If this reply helps you, Karma would be appreciated.

ygoltsev
Engager

This is helpful thanks!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...