Splunk 101: Creating Event Types and Tags

Josh again, to walk you through another quick Splunk tutorial that will help you track to CIM compliance. In this video tutorial, I’ll discuss the importance of creating event types and tags in Splunk. Creating event types and tags may seem simple… but taking the steps to categorize your data early on is crucial when building your data model. Here are some takeaways from the video when you’re using event types and tags in Splunk…

Key Takeaways from Creating Event Types and Tags in Splunk

  • Utilize event types and tags to categorize events within your data… making searching easier to collectively look at your data.
  • Match your actions with your tag names. For example, if your field pair value is action = purchase, your tag name will be purchase. You can create custom values if there is a specific type of information you want to see.
  • Within Enterprise Security, there are a lot of dashboards and searches that run off information that’s being pushed to the data models. Not only should that information be CIM compliant, but it also needs to have event types and tags because it’s looking for those specific types of that information.
  • Within a data model, there could be different types of events there. Examples of events:  logins, logoffs, timeouts, lockouts, etc. Use tags and event types to categorize these events… rather than just using your default fields and index and source types… allowing your data models to quickly identify what data you’re looking for.
  • Tagging and naming with event types is an essential step BEFORE you start building your data models and save you time in the long run.

Meet our Expert Team

You may have read a few of my Splunk Search Command Series blogs, both myself, and our engineers here at Kinney Group produce weekly content around Splunk best practices. My team, the Tech Ops team, runs our Expertise on Demand service, which I’ll touch on a little more below. Our EOD team is responsible for knowing everything and anything around Splunk best practice… that’s why you’ll get access to a ton of video and written content from our team. EOD is designed to answer your team’s daily questions and breakthrough stubborn roadblocks.  Let us know below how we can help.

Author

Start typing and press Enter to search