Configure and deploy indexes
implements custom indexes for event storage. The indexes are defined across the apps provided with .
- In a single instance deployment, the installation of Enterprise Security creates the indexes in the default path for data storage.
- In a Splunk Cloud deployment, customers work with Splunk Support to set up, manage, and maintain their cloud index parameters. See Manage Splunk Cloud indexes in the Splunk Cloud Admin Manual.
- In a distributed deployment, create the indexes on all Splunk platform indexers or search peers.
Index configuration
The indexes defined in do not provide configuration settings to address:
- Multiple storage paths
- Accelerated data models
- Data retention
- Bucket sizing
- Use of volume parameters.
For detailed examples of configuring indexes, see indexes.conf.example in the Splunk Enterprise Admin Manual.
Indexes by app
App context | Index | Description |
---|---|---|
DA-ESS-AccessProtection | gia_summary |
Summary index used by the Geographically Improbable Access panel on the Access Anomalies dashboard. |
DA-ESS-ThreatIntelligence | ioc |
Unused in this release. |
threat_activity |
Contains events that result from a threat list match. | |
SA-EndpointProtection | endpoint_summary |
Endpoint protection summary index. |
SA-NetworkProtection | whois |
WHOIS data index. |
SA-ThreatIntelligence | notable |
Contains the notable events. |
notable_summary |
Contains a stats summary of notable events used on select dashboards. | |
risk |
Contains the risk modifier events. | |
Splunk_SA_CIM | cim_summary |
Unused in this release. |
cim_modactions |
Contains the adaptive response action events. | |
Splunk_SA_ExtremeSearch | xtreme_contexts |
Contains the contexts for Extreme search. |
Splunk_TA_ueba | ubaroute |
Does not contain event data. Used behind the scenes for routing to your UBA target. |
ueba |
Contains UBA events. |
Add-ons can include custom indexes defined in an indexes.conf
file.
Index deployment
includes a tool to gather the indexes.conf
and index-time props.conf
and transforms.conf
settings from all enabled apps and add-ons on the search head and assemble them into one add-on. For more details, see Deploy add-ons included with Splunk Enterprise Security in this manual.
Integrate Splunk Stream with Splunk Enterprise Security | Configure users and roles |
This documentation applies to the following versions of Splunk® Enterprise Security: 5.0.0, 5.0.1, 5.1.0, 5.1.1
Feedback submitted, thanks!