Hi,
I'm curious to know when the logs will be indexed after the incident triggered in Splunk.
Thanks
Hi @AL3Z ,
could you better describe your question?
logs are indexed when they arrive in Splunk.
Are you speaking of Splunk Enterprise or Enterprise Security?
Anyway, when an alert is triggered the alert is written in an indexor in the triggered alerts list or in a lookup depending on the action the you defined for that alert.
Ciao.
Giuseppe
Hi @gcusello ,
When do logs arrive in Splunk after a user has performed an activity
Hi @AL3Z,
sorry but I continue to not understand: are you speaking of an activiy on Splunk or on a target system?
if on Splunk, it depends on the action that you associated to the alert(you can create a Noteble, send an eMail, write in an index or i a lookup, etc...)
if on the target system, it depends on how you ingest logs from the target system.
Ciao.
Giuseppe