Hello everyone, I am planning to automate a process where we need to archive admin activity for splunk application. For that I would require a query to fetch all the privileged actions conducted by admins inside splunk application. My first thought is to use the following query: index=_audit sourcetype="audittrial" action=edit* OR action=create* OR action=delete* OR action=restart* Unfortunately, this query is emitting a lot of data ( around 900MB per day ) which the platform that I am using for automation can´t work with.  => Is there maybe any query that I can use to get the data I need in a more specific way to the point where it reduces the size to 20 MB or something ? I would appreciate any help and thank you in advance !   ... View more

Hello Splunk Community, For compliance reasons, I need to figure out an efficient way to archive notable events that is generated from the correlation searches in enterprise security. My first thought is to create an index for these notable events and configure dynamic data self storage. Is this a good solution and feasable in splunk enterprise ? I would appreciate any support here and thank you in advance ! ... View more