Verify CrowdStrike data input

Verify your CrowdStrike data input in Data Manager by checking the deployment status and reviewing ingestion metrics.

You can verify your CrowdStrike data input in Data Manager by checking the deployment status and reviewing ingestion metrics. Use any of the following methods:

• View the deployment summary status in Data Manager.
• View the Data Management home page in Data Manager.
• On the Data Management page, in the Ingest inputs tab, select a CrowdStrike input name to open the details pane and review the input configuration, including sensor event filters and device enrichment settings.

1. Log in to Splunk Cloud and select Data Manager.
2. On the Data Management page, select the Ingest inputs tab.
3. Select the CrowdStrike input name to open the details pane.

   The details pane displays the input configuration, deployment status, and any alerts. If your CrowdStrike API credentials have expired, a notification appears in the details pane.

4. (Optional) If the details pane shows expired CrowdStrike credentials, select the option to update the credentials.

   Because CrowdStrike client configurations are shared resources, updating the credentials applies the change to all inputs that use the same configuration.