Splunk ES fortinet new source

[splunkcol]

Hello,

I was given the administration of a Splunk Enterprise Security and I am not familiarized, I have always used manual queries from "Search & reporting" I have the knowledge level of Fundamentals 1 and 2.

Splunk ES currently works and I can see noticeable events from paloalto firewalls but recently configured fortinet logs and these are already coming in under an index called fortinet, when doing a normal query with index=fortinet I can see events but I see nothing from Splunk ES.

Exactly what do I need to do to get the fortinet events to be taken into account by Splunk ES and start logging notable events?

[richgalloway]

I strongly encourage you to take the free Using Splunk ES (Using Splunk Enterprise Security ) and the (not free) Administering Splunk ES (Administering Splunk Enterprise Security ) courses.

ES uses correlation searches to create notable events.  A CS is like a saved search, but will a few added attributes.  You can create a CS in ES by going to Configuration->Content Management and clicking on the New Correlation Search button.