Splunk Enterprise Security

ES app. bringing in _internal data into dashboards

Path Finder

Hello,

I am seeing that ES app. also brings in data from the _internal index and add it to the ES application dashboards.

For example, I am seeing in the Access dashboard that it brings in a lot of data from *-too_small data files which are related to splunk running remote searches.

what is the best way to actually filter out these events from not being searched by the Splunk dashboards? I don't want to actually go and edit every single dashboard and modify the searches, but on the other hand I still want this data to be stored in the _internal index as well.

Thank you.

0 Karma

Splunk Employee
Splunk Employee

Easiest way would be to update the constraints in the data models to no include those sourcetypes. E.g., in the Authentication Datamodel, the default constraints are "tag=authentication OR index!=_internal OR sourcetype!=*-too-small"

Once you change that, you can rebuild the data model and it should clear out the events.

0 Karma

Path Finder

Hello Guys/Girls,

just as an update so far I have filtered out the events in a manual way using the following query:

//Original
| tstats summariesonly min(time) as firstTime,max(time) as lastTime from datamodel=Authentication where Authentication.app!=unknown by Authentication.app
| drop_dm_object_name("Authentication")
| inputlookup append=T accessapptracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by app
| outputlookup accessapptracker
| stats count

//Modified
| tstats summariesonly min(time) as firstTime,max(time) as lastTime from datamodel=Authentication where Authentication.app!=unknown Authentication.app!=*_small by Authentication.app
| drop_dm_object_name("Authentication")
| inputlookup append=T accessapptracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by app
| outputlookup accessapptracker
| stats count

0 Karma