Splunk Enterprise Security

Splunk Stream Built-in stream populating Dashboard vs Protocol Events

Path Finder

Hi there,

I have deployed Splunk Stream on a distributed environment.

SH ES > Stream App + Stream TA
IDX > Stream TA
Win UF > Stream TA + imputs config received from SH ES

It worked with DNS data so I did not pay much attention to it, but then I realized I could only pull data from Streams entitled "Built-in stream populating XXX Dashboard".

The ones named XXX Protocol Events, I am not able to pull data from it.

Anyone knows the difference between Built-in stream populating XXX Dashboard & XXX Protocol Events stream.

What could be the cause for having one kind working and not the other one ?

I have tried to investigate _internal data without luck so far.

Thanks in advance for any advice,

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Hello @support0,

Only streams populating the dashboards are enabled out of the box when you install Stream. You need to enable other streams and make sure they're properly assigned to the forwarder groups using the Splunk App for Stream config UI.

View solution in original post

Path Finder

I had completely missed the "Configured Streams" part, thanks!!

0 Karma

Splunk Employee
Splunk Employee

Hello @support0,

Only streams populating the dashboards are enabled out of the box when you install Stream. You need to enable other streams and make sure they're properly assigned to the forwarder groups using the Splunk App for Stream config UI.

View solution in original post