Splunk Enterprise Security

How to find source and sourcetype of notable

DawoodKhanUlex
Engager

Hi Folks,

I want find all source and sourcetype for enable notables in Splunk ES.

Please advise.

Regards,

D

Labels (1)
Tags (2)
0 Karma

ololdach
Builder

Hi, the way I understand your question is that you are looking for the configuration file with the definition of the source and the sourcetype for the events in the notable index of ES. The answer to that question is: There are none. The notable index is being populated through correlation searches that end in a ...| collect ... command that writes the result of the correlation search to the notable index. See this page for more information on how to use collect to write data to an index:  https://docs.splunk.com/Documentation/SplunkCloud/8.1.2008/SearchReference/Collect

Cheers

Oliver

 

Tags (1)
0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee

Did you try a search for index=notable & then see the source and sourcetype as selected fields or interesting fields in the results?  

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...