Getting Data In

How To optimize eps aggregation and filtration in splunk

etaihellman
Engager

Hello guys,

i'm working with a costumer which wants to replace arcsight with splunk.

we're moving some systems from the arcsight and while we added "Fireglass" (by symantec) to monitoring we saw extreme growth in the license which almost caused to violations.

while digging in at the logs we saw that some sites, like youtube takes something like 1000 events for time frame of 1 minute. looking deeper i could see that all the video\audio traffic was sent as well. the customer told me that in Arcsight there's an option for "aggregation and filtration", which he can take the number of logs which are the same and merge them as one event, and ingest the whole traffic.

here's an explanation about the operation from the Arcsight side:

ArcSight. Optimizing EPS (Aggregation and Filtration) - SOC Prime

my question: can i make something like this with splunk? with a license of 100G the fireglass takes like 60G.

thanks in advance 

Etai 🙂

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...