Splunk Enterprise Security

How to find source and sourcetype of notable

DawoodKhanUlex
Engager

Hi Folks,

I want find all source and sourcetype for enable notables in Splunk ES.

Please advise.

Regards,

D

Labels (1)
Tags (2)
0 Karma

ololdach
Builder

Hi, the way I understand your question is that you are looking for the configuration file with the definition of the source and the sourcetype for the events in the notable index of ES. The answer to that question is: There are none. The notable index is being populated through correlation searches that end in a ...| collect ... command that writes the result of the correlation search to the notable index. See this page for more information on how to use collect to write data to an index:  https://docs.splunk.com/Documentation/SplunkCloud/8.1.2008/SearchReference/Collect

Cheers

Oliver

 

Tags (1)
0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee

Did you try a search for index=notable & then see the source and sourcetype as selected fields or interesting fields in the results?  

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...