Getting Data In

What is the exact Splunk DB path in Email Security Appliance?

dhsetty
Explorer

Hello All,

Currently we are using Splunk with Email Security Appliance.
All I know is the command ---> du -sk /data/db/splunk , to know the space consumed by Splunk DB.

But could you please help me with the path of Splunk, where Message Tracking, Reporting data is stored in Email Security Appliance.

Thanks & Regards,
Dharmendra Setty

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Cisco sells an email security appliance; this device produces log files of its activity. Splunk has an app that understands the logs from the Cisco ESA: Splunk Add-on for Cisco ESA The documentation for the Splunk Add-on for Cisco ESA is here

When you set up the Splunk inputs, you choose the index for the Cisco ESA data. And in indexes.conf on the indexer(s), you specify where disk space is allocated for the indexes.

You can use the Splunk Monitoring Console to see how much disk space is used by each index. But you will have to look at your configuration to determine where the Cisco ESA data is stored.

View solution in original post

0 Karma

lguinn2
Legend

Cisco sells an email security appliance; this device produces log files of its activity. Splunk has an app that understands the logs from the Cisco ESA: Splunk Add-on for Cisco ESA The documentation for the Splunk Add-on for Cisco ESA is here

When you set up the Splunk inputs, you choose the index for the Cisco ESA data. And in indexes.conf on the indexer(s), you specify where disk space is allocated for the indexes.

You can use the Splunk Monitoring Console to see how much disk space is used by each index. But you will have to look at your configuration to determine where the Cisco ESA data is stored.

0 Karma

dhsetty
Explorer

Hi Iguinn[Splunk],

How to use the Splunk Monitoring Console, to see the disk space usage by each index.

Can you please share me the steps on usage of Splunk Monitoring Console.

Thanks & Regards,
Dharmendra Setty

0 Karma

dhsetty
Explorer

Also my requirement is:

Suppose I make a Splunk DB Query as below:
a=1
b=1000

search_parms = {'date_from': '1/10/2016:05:00', 'start': a, 'stop': b, 'timeout': 60, 'date_to': '02/22/2017:23:39', 'mask_prvs': 0, 'maxresults': 100000},

So, the Splunk response is bucketed output grouping based on MIDs.
a. How to delete these results from Splunk DB which are indexed?
b. How to find the Splunk DB storage space after deleted?

Thanks & Regards,
Dharmendra Setty

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...