The documentation for Splunk Enterprise Security versions 8.0 and higher have been rearchitected from previous versions, causing some links to have redirect errors. For documentation on version 8.0, see Splunk Enterprise Security 8.x documentation.
This documentation does not apply to the most recent version of Splunk® Enterprise Security.
For documentation on the most recent version, go to the latest release.
Managing content in Splunk Enterprise Security
As a Splunk Enterprise Security administrator, you can use the Content Management page to display, create, configure, and edit content that is unique to Splunk Enterprise Security, such as correlation searches, key indicators, saved searches, and swim lane searches.
- Create correlation searches in Splunk Enterprise Security
- Create and manage data models in Splunk Enterprise Security
- Create and manage key indicator searches in Splunk Enterprise Security
- Create and manage lookups in Splunk Enterprise Security
- Create and manage saved searches in Splunk Enterprise Security
- Create and manage search-driven lookups in Splunk Enterprise Security
- Create and manage views in Splunk Enterprise Security
- Export content from Splunk Enterprise Security as an app
- Create and edit risk objects in Splunk Enterprise Security
- Create risk factors in Splunk Enterprise Security
- Manage risk factors in Splunk Enterprise Security
- Use default risk factors in Splunk Enterprise security
Last modified on 16 May, 2023
| Example: Add a generic intelligence source to Splunk Enterprise Security | Create and manage data models in Splunk Enterprise Security |
This documentation applies to the following versions of Splunk® Enterprise Security: 6.4.0, 6.4.1, 6.5.0 Cloud only, 6.5.1 Cloud only, 6.6.0, 6.6.2
Download manual
Feedback submitted, thanks!