Splunk Enterprise Security

How to load data into the Splunk App for Enterprise Security?

geosujith
New Member

What is the procedure to load the data into the Splunk App for Enterprise Security?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

As a general statement, all data in Splunk that you want to use in ES needs to be CIM compliant. These means that the TA's used to parse events, extract and alias fields, all need to have CIM compliant mappings.

@ekost's link is a good starting point, along with : http://docs.splunk.com/Documentation/CIM/4.2.0/User/Overview

0 Karma

ekost
Splunk Employee
Splunk Employee

You'll find a page in the docs here that discusses data onboarding for ES.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>