Hmm, I'm not so sure. Wouldn't normalizing the data to the Splunk Common Information Model be important too? That would help ensure consistency and compatibility with ES.
This question is a bit tricky, but I think the key is understanding the Data Model and how it interacts with Elasticsearch (ES). If the raw data isn't properly extracted and normalized, it won't be usable by the Data Model or ES.
upvoted 0 times
...
Log in to Pass4Success
Sign in:
Report Comment
Is the comment made by USERNAME spam or abusive?
Commenting
In order to participate in the comments you need to be logged-in.
You can sign-up or
login
Lashon
6 months agoZona
6 months agoJuan
6 months agoMike
7 months agoGlenna
7 months agoIzetta
7 months agoSalome
7 months agoAdell
5 months agoClare
5 months agoNorah
6 months agoDelsie
6 months agoBuddy
7 months agoLeonora
7 months agoFrancine
8 months ago