ES app. bringing in _internal data into dashboards

[dimitris_vergos]

Hello,

I am seeing that ES app. also brings in data from the _internal index and add it to the ES application dashboards.

For example, I am seeing in the Access dashboard that it brings in a lot of data from *-too_small data files which are related to splunk running remote searches.

what is the best way to actually filter out these events from not being searched by the Splunk dashboards? I don't want to actually go and edit every single dashboard and modify the searches, but on the other hand I still want this data to be stored in the _internal index as well.

Thank you.

[esix_splunk]

Easiest way would be to update the constraints in the data models to no include those sourcetypes. E.g., in the Authentication Datamodel, the default constraints are "tag=authentication OR index!=_internal OR sourcetype!=*-too-small"

Once you change that, you can rebuild the data model and it should clear out the events.

[dimitris_vergos]

Hello Guys/Girls,

just as an update so far I have filtered out the events in a manual way using the following query:

//Original
| tstats summariesonly min(_time) as firstTime,max(_time) as lastTime from datamodel=Authentication where Authentication.app!=unknown by Authentication.app
| drop_dm_object_name("Authentication")
| inputlookup append=T access_app_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by app
| outputlookup access_app_tracker
| stats count

//Modified
| tstats summariesonly min(_time) as firstTime,max(_time) as lastTime from datamodel=Authentication where Authentication.app!=unknown Authentication.app!=*_small by Authentication.app
| drop_dm_object_name("Authentication")
| inputlookup append=T access_app_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by app
| outputlookup access_app_tracker
| stats count