Splunk Enterprise Security

How to load data into the Splunk App for Enterprise Security?

geosujith
New Member

What is the procedure to load the data into the Splunk App for Enterprise Security?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

As a general statement, all data in Splunk that you want to use in ES needs to be CIM compliant. These means that the TA's used to parse events, extract and alias fields, all need to have CIM compliant mappings.

@ekost's link is a good starting point, along with : http://docs.splunk.com/Documentation/CIM/4.2.0/User/Overview

0 Karma

ekost
Splunk Employee
Splunk Employee

You'll find a page in the docs here that discusses data onboarding for ES.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...