Logs

[SN1]

i want to know in which index is microsoft defender logs getting stored , I know some important fields which are there in microsoft defender and now i want to find them whether they are getting stored or not .

[gcusello]

Hi @SN1 ,

as @isoutamo said, index is defined in the used Add-on.

Anyway, Splunk isn't a database, so the field definition is indipendent from the index where logs are stored and you can see the fields wherever they are stored.

If you don't see the fields, see the add-on you used.

Ciao.

Giuseppe

[isoutamo]

Hi

those are always your organization's decisions. Usually there be some naming standards which define those index names. Best option is to ask it from your Splunk admin or look your internal documentation.

One option is try 

| metadata type=hosts index=*

which shows what hosts has sent events to indexes on your selected time slot.

r. Ismo