Splunk Enterprise Security

Splunk Enterprise Security: How to constrain data models to certain sourcetypes/indexes?

ahmedhassanean
Explorer

dears,

I have installed Splunk Enterprise Security on splunk and I would like to constrain specific data model to specific splunk indexes but I have a lot of data and a lot of indexes how can I map which data model need which sourcetypes/indexes

0 Karma

starcher
Influencer

http://docs.splunk.com/Documentation/ES/4.7.4/Install/Datamodels

Section: Constrain data model searches to specific indexes

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...