Getting Data In

Log indexing in to splunk

AL3Z
Builder

Hi,

I'm curious to know when the logs will be indexed after the incident triggered in Splunk.

Thanks

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @AL3Z ,

could you better describe your question?

logs are indexed when they arrive in Splunk.

Are you speaking of Splunk Enterprise or Enterprise Security?

Anyway, when an alert is triggered the alert is written in an indexor in the triggered alerts list or in a lookup depending on the action the you defined for that alert.

Ciao.

Giuseppe

0 Karma

AL3Z
Builder

Hi @gcusello ,

When do logs arrive in Splunk after a user has performed an activity

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @AL3Z,

sorry but I continue to not understand: are you speaking of an activiy on Splunk or on a target system?

if on Splunk, it depends on the action that you associated to the alert(you can create a Noteble, send an eMail, write in an index or i a lookup, etc...)

if on the target system, it depends on how you ingest logs from the target system.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...