Splunk Enterprise Security

Splunk Stream Built-in stream populating Dashboard vs Protocol Events

support0
Path Finder

Hi there,

I have deployed Splunk Stream on a distributed environment.

SH ES > Stream App + Stream TA
IDX > Stream TA
Win UF > Stream TA + imputs config received from SH ES

It worked with DNS data so I did not pay much attention to it, but then I realized I could only pull data from Streams entitled "Built-in stream populating XXX Dashboard".

The ones named XXX Protocol Events, I am not able to pull data from it.

Anyone knows the difference between Built-in stream populating XXX Dashboard & XXX Protocol Events stream.

What could be the cause for having one kind working and not the other one ?

I have tried to investigate _internal data without luck so far.

Thanks in advance for any advice,

0 Karma
1 Solution

vshcherbakov_sp
Splunk Employee
Splunk Employee

Hello @support0,

Only streams populating the dashboards are enabled out of the box when you install Stream. You need to enable other streams and make sure they're properly assigned to the forwarder groups using the Splunk App for Stream config UI.

View solution in original post

support0
Path Finder

I had completely missed the "Configured Streams" part, thanks!!

0 Karma

vshcherbakov_sp
Splunk Employee
Splunk Employee

Hello @support0,

Only streams populating the dashboards are enabled out of the box when you install Stream. You need to enable other streams and make sure they're properly assigned to the forwarder groups using the Splunk App for Stream config UI.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...