- Find Answers
- :
- Premium Solutions
- :
- Splunk Enterprise Security
- :
- Auditing Datamodels
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
Is there a way to validate the fields used in the datamodel by how compliant they are with the current setup?
I am trying to validate and fix data models to receive optimum results in the Splunk ES.
Any tips regarding the issue will be appreciated,
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Would this help? https://docs.splunk.com/Documentation/ES/5.2.2/Admin/Dashboardrequirements
Also, for e.g. You can use | from datamodel "Authentication.Authentication" | fieldsummary for Authentication datamodel to check if all the datamodel fields are mapped and check the valued to see if they are related to your datasource.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
if you are happy with the answers provided and/or your issue resolved, can you pls accept the response to close tracking on this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sure, Sorry im new to Splunk Answers.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is also the function fieldsummary.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Would this help? https://docs.splunk.com/Documentation/ES/5.2.2/Admin/Dashboardrequirements
Also, for e.g. You can use | from datamodel "Authentication.Authentication" | fieldsummary for Authentication datamodel to check if all the datamodel fields are mapped and check the valued to see if they are related to your datasource.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Fantastic, Exactly what I needed. Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try this app
https://splunkbase.splunk.com/app/2968/
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
