Hello,
I am seeing that ES app. also brings in data from the _internal index and add it to the ES application dashboards.
For example, I am seeing in the Access dashboard that it brings in a lot of data from *-too_small data files which are related to splunk running remote searches.
what is the best way to actually filter out these events from not being searched by the Splunk dashboards? I don't want to actually go and edit every single dashboard and modify the searches, but on the other hand I still want this data to be stored in the _internal index as well.
Thank you.
Easiest way would be to update the constraints in the data models to no include those sourcetypes. E.g., in the Authentication Datamodel, the default constraints are "tag=authentication OR index!=_internal OR sourcetype!=*-too-small"
Once you change that, you can rebuild the data model and it should clear out the events.
Hello Guys/Girls,
just as an update so far I have filtered out the events in a manual way using the following query:
//Original
| tstats summariesonly
min(_time) as firstTime,max(_time) as lastTime from datamodel=Authentication where Authentication.app!=unknown by Authentication.app
| drop_dm_object_name("Authentication")
| inputlookup append=T access_app_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by app
| outputlookup access_app_tracker
| stats count
//Modified
| tstats summariesonly
min(_time) as firstTime,max(_time) as lastTime from datamodel=Authentication where Authentication.app!=unknown Authentication.app!=*_small by Authentication.app
| drop_dm_object_name("Authentication")
| inputlookup append=T access_app_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by app
| outputlookup access_app_tracker
| stats count