Splunk Enterprise Security

ES app. bringing in _internal data into dashboards

dimitris_vergos
Path Finder

Hello,

I am seeing that ES app. also brings in data from the _internal index and add it to the ES application dashboards.

For example, I am seeing in the Access dashboard that it brings in a lot of data from *-too_small data files which are related to splunk running remote searches.

what is the best way to actually filter out these events from not being searched by the Splunk dashboards? I don't want to actually go and edit every single dashboard and modify the searches, but on the other hand I still want this data to be stored in the _internal index as well.

Thank you.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Easiest way would be to update the constraints in the data models to no include those sourcetypes. E.g., in the Authentication Datamodel, the default constraints are "tag=authentication OR index!=_internal OR sourcetype!=*-too-small"

Once you change that, you can rebuild the data model and it should clear out the events.

0 Karma

dimitris_vergos
Path Finder

Hello Guys/Girls,

just as an update so far I have filtered out the events in a manual way using the following query:

//Original
| tstats summariesonly min(_time) as firstTime,max(_time) as lastTime from datamodel=Authentication where Authentication.app!=unknown by Authentication.app
| drop_dm_object_name("Authentication")
| inputlookup append=T access_app_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by app
| outputlookup access_app_tracker
| stats count

//Modified
| tstats summariesonly min(_time) as firstTime,max(_time) as lastTime from datamodel=Authentication where Authentication.app!=unknown Authentication.app!=*_small by Authentication.app
| drop_dm_object_name("Authentication")
| inputlookup append=T access_app_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by app
| outputlookup access_app_tracker
| stats count

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...