Splunk Enterprise Security

In Intelligence Downloads setting what is Maximum age?

Loves-to-Learn Lots

When I configuring threat feeds in ES . In  Intelligence Downloads setting there is Maximum age  for threat intel downloads. Does anyone know what is Maximum age field.


0 Karma


Yes, the Maximum age field is to define the retention period for this threat source, defined in relative time. 

The default maximum age is -30d for 30 days of retention in the KV Store. To remove the data more often, use a smaller number such as -7d for one week of retention. The maximum age field cannot be left black because storing the collection indefinitely can impact performance.

Basically it removes threat intelligence from the KV Store collections in Splunk Enterprise Security based on the date that the threat intelligence was added to Enterprise Security.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...