Splunk Enterprise Security

How to load data into the Splunk App for Enterprise Security?

geosujith
New Member

What is the procedure to load the data into the Splunk App for Enterprise Security?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

As a general statement, all data in Splunk that you want to use in ES needs to be CIM compliant. These means that the TA's used to parse events, extract and alias fields, all need to have CIM compliant mappings.

@ekost's link is a good starting point, along with : http://docs.splunk.com/Documentation/CIM/4.2.0/User/Overview

0 Karma

ekost
Splunk Employee
Splunk Employee

You'll find a page in the docs here that discusses data onboarding for ES.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...