topic About installing Splunk Enterprise Security in Deployment Architecture

About installing Splunk Enterprise Security

masakazu — Thu, 05 Dec 2024 07:03:09 GMT

https://docs.splunk.com/Documentation/ES/7.3.2/Install/InstallEnterpriseSecurity

I installed Splunk Enterprise Security to verify operation,
following the above manual, I installed and configured the initial settings.

When I opened the incident view in the app's menu bar,
an error message appeared saying "An error occurred while loading some filters."

When I opened the investigation,
an error message appeared saying "Unknown Error: FAiled to fetch KV Store."

I can't display the incident review and investigation.
Is anyone else experiencing the same issue?

Re: About installing Splunk Enterprise Security

gcusello — Thu, 05 Dec 2024 07:38:58 GMT

Hi @masakazu ,

did you followed all the instructions in the above link?

I never exerimented the above issue.

My hint is to repeat all the steps in the installation procedure, checking if you have kv-Store issues in your Splunk installation.

If you don't solve, open a case to Splunk Support.

Ciao.

Giuseppe

Re: About installing Splunk Enterprise Security

PickleRick — Thu, 05 Dec 2024 10:00:10 GMT

ES depends heavily on kvstore. If - for some reason - your installation didn't complete correctly and your kvstore isn't fully configured it won't run properly. If your kvstore is not running, ES (and much of the "general Splunk") won't run either. But as far as I remember you might get this kind of problems as well if your user simply doesn't have required capabilities and permissions for running ES.

Re: About installing Splunk Enterprise Security

masakazu — Fri, 06 Dec 2024 01:55:43 GMT

PickleRick-san
gcusello-san
Thank you for response.

As you pointed out, KVstore did not seem to be working properly.
I reinstalled it with Fips-mode turned off and it worked fine.

Is it impossible to install SplunkES on a Splunk Server running in Fips-mode?

Re: About installing Splunk Enterprise Security

gcusello — Fri, 06 Dec 2024 06:59:52 GMT

Hi @masakazu ,

I don't live in US so I never installed Splunk in FIPS Mode, but reading the related documentation ( https://docs.splunk.com/Documentation/Splunk/9.3.2/Security/SecuringSplunkEnterprisewithFIPs ), I don't see any known issue on ES or KV-Store.

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Ciao.

Giuseppe