Skip Navigation
  1. BlackBerry Docs
  2. Cylance products
  3. CylancePROTECT Application for Splunk Administration Guide
  4. Installing and configuring the CylancePROTECT Application for Splunk
  5. Configure an event index

Configure an event index

The data that
Splunk
 processes resides in an index.
Splunk
 does not create an index by default, so you must set up an event index after you install the
CylancePROTECT
 Application for
Splunk
. An event index can hold any type of data.
  1. In
    Splunk
    , on the menu bar, click
    Settings
     >
    Indexes
     >
    New Index
    .
  2. In the
    New Index
     dialogue box, fill in the fields.
    We recommend you use cylance_protect as the index name. If you use a custom index name, the eventtype=cylance_index must be modified to accept the custom index name.
  3. Click
    Save
    .
  4. On the menu bar, click
    Settings
     >
    Event Types
     to confirm that the search string appears as
    index=protect OR index=Cylance_protect
    .
  5. In
    Settings
    , click
    Advanced Search
    >
    Search Macros
     and confirm that the search string appears as
    index=protect OR index=Cylance_protect
    .
    When you upgrade your
    Splunk
     environment, there should be an existing index, and the existing configuration files in local should contain the correct file name. In some cases, local files that may have been created for previous installations (for example, files that contain default.xml) will override menus added in the new release. To correct this, either delete the local file or restart the
    Splunk
     search head using the
    $SPLUNK_HOME/bin/splunk restart
    command.