Log indexing in to splunk

[smith_]

Hi,

I'm curious to know when the logs will be indexed after the incident triggered in Splunk.

Thanks

[gcusello]

Hi @smith_ ,

could you better describe your question?

logs are indexed when they arrive in Splunk.

Are you speaking of Splunk Enterprise or Enterprise Security?

Anyway, when an alert is triggered the alert is written in an indexor in the triggered alerts list or in a lookup depending on the action the you defined for that alert.

Ciao.

Giuseppe

[smith_]

Hi @gcusello ,

When do logs arrive in Splunk after a user has performed an activity

[gcusello]

Hi @smith_,

sorry but I continue to not understand: are you speaking of an activiy on Splunk or on a target system?

if on Splunk, it depends on the action that you associated to the alert(you can create a Noteble, send an eMail, write in an index or i a lookup, etc...)

if on the target system, it depends on how you ingest logs from the target system.

Ciao.

Giuseppe