Knowledge Management

How splunk kv store Ip_intel or http_intel got updated

abdulshemeer163
New Member

How splunk kv store "Ip_intel" or "http_intel" got updated. Is there any saved search behind that.
Where do I see the update interval.

As I can see all my data downloaded from the feed is dumped in SA App threat_intel (Drop Box)
But Iam not sure how it get update to the KV store (http_intel or ip_intel)

Can some one shed a light on this

Tags (1)
0 Karma

AbubakarShahid
New Member

I believe there is back end search that does that. I am also wondering the same thing.

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...