Configure and deploy indexes

implements custom indexes for event storage. The indexes are defined across the apps provided with .

• In a single instance deployment, the installation of Enterprise Security creates the indexes in the default path for data storage.
• In a Splunk Cloud deployment, customers work with Splunk Support to set up, manage, and maintain their cloud index parameters. See Manage Splunk Cloud indexes in the Splunk Cloud Admin Manual.
• In a distributed deployment, create the indexes on all Splunk platform indexers or search peers.

Index configuration

The indexes defined in do not provide configuration settings to address:

• Multiple storage paths
• Accelerated data models
• Data retention
• Bucket sizing
• Use of volume parameters.

For detailed examples of configuring indexes, see indexes.conf.example in the Splunk Enterprise Admin Manual.

Indexes by app

App context	Index	Description
DA-ESS-AccessProtection	gia_summary	Summary index used by the Geographically Improbable Access panel on the Access Anomalies dashboard.
DA-ESS-ThreatIntelligence	ioc	Unused in this release.
	threat_activity	Contains events that result from a threat list match.
SA-AuditAndDataProtection	audit_summary	Audit and Data Protection summary index.
SA-EndpointProtection	endpoint_summary	Endpoint protection summary index.
SA-NetworkProtection	whois	WHOIS data index.
SA-ThreatIntelligence	notable	Contains the notable events.
	notable_summary	Contains a stats summary of notable events used on select dashboards.
	risk	Contains the risk modifier events.
Splunk_SA_CIM	cim_summary	Unused in this release.
	cim_modactions	Contains the adaptive response action events.
Splunk_SA_ExtremeSearch	xtreme_contexts	Contains the contexts for Extreme search.
Splunk_TA_ueba	ubaroute	Does not contain event data. Used behind the scenes for routing to your UBA target.
	ueba	Contains UBA events.
SplunkEnterpriseSecuritySuite	sequenced_events	Contains sequenced event data, after the successful termination of a sequence template.

Add-ons can include custom indexes defined in an indexes.conf file.

Index deployment

includes a tool to gather the indexes.conf and index-time props.conf and transforms.conf settings from all enabled apps and add-ons on the search head and assemble them into one add-on. For more details, see Deploy add-ons included with Splunk Enterprise Security in this manual.