Splunk Enterprise Security

Splunk Enterprise Security: Can I hold all the events which matched my correlation search?

nandha_2
Engager

can i hold all the events which matched the correlation search in Splunk Enterprise Security, before it gets indexed in the notable index?

so thats like --> Cor.search runs --> (store all the contributing events in a file) --> then allow splunk to index in the index=notable disk.

Is this possible to add a script before Splunk index events to index notable ?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi nandha_2,

using Splunk, you can only filter events using regexes (see http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad).

If you want to pre-parse your logs before indexing, you have to run a pre-parsing script outside Splunk and index the output file.

To do this is easy if you have a syslog data flow or a file on the Splunk server, but less easy if you receive logs via Forwarder, because, you have to distribute the external script in every Forwarder.
In addition, you lose the real time monitoring because there is always a delay between the log arrive and the indexing time.

We asked to Splunk to insert the possibility to run a script before indexing, but not yet.

Bye.
Giuseppe

0 Karma

nandha_2
Engager

Could you please explain me what happens when the correlation search matches a set of events. Does spunk store this in a memory or file before it load it's data to index notable?

0 Karma

gcusello
SplunkTrust
SplunkTrust

all the Splunk's search results (correlation or not) are stored in a file for a configurable time and they are reusable.
you can find it in [Settings -- Processes].
If instead you want information on the search run use "Job properties"
Bye.
Giuseppe

0 Karma

nandha_2
Engager

I am not sure if you understood my question rightly !? . This is regarding Splunk Enterprise security App. An security analyst can configure correlation search which scan data and take an action creating a notables.

http://docs.splunk.com/Documentation/PCI/3.3.0/Install/Correlationsearches

So, it matches against a set of data. does splunk store those matches data in memory or a file before creating a notable. it has to store somewhere before creating a notable.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...