Splunk Enterprise Security

ES app. bringing in _internal data into dashboards

dimitris_vergos
Path Finder

Hello,

I am seeing that ES app. also brings in data from the _internal index and add it to the ES application dashboards.

For example, I am seeing in the Access dashboard that it brings in a lot of data from *-too_small data files which are related to splunk running remote searches.

what is the best way to actually filter out these events from not being searched by the Splunk dashboards? I don't want to actually go and edit every single dashboard and modify the searches, but on the other hand I still want this data to be stored in the _internal index as well.

Thank you.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Easiest way would be to update the constraints in the data models to no include those sourcetypes. E.g., in the Authentication Datamodel, the default constraints are "tag=authentication OR index!=_internal OR sourcetype!=*-too-small"

Once you change that, you can rebuild the data model and it should clear out the events.

0 Karma

dimitris_vergos
Path Finder

Hello Guys/Girls,

just as an update so far I have filtered out the events in a manual way using the following query:

//Original
| tstats summariesonly min(_time) as firstTime,max(_time) as lastTime from datamodel=Authentication where Authentication.app!=unknown by Authentication.app
| drop_dm_object_name("Authentication")
| inputlookup append=T access_app_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by app
| outputlookup access_app_tracker
| stats count

//Modified
| tstats summariesonly min(_time) as firstTime,max(_time) as lastTime from datamodel=Authentication where Authentication.app!=unknown Authentication.app!=*_small by Authentication.app
| drop_dm_object_name("Authentication")
| inputlookup append=T access_app_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by app
| outputlookup access_app_tracker
| stats count

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...