topic Re: ES notable index empty resulting empty notable dashboards in Getting Data In

ES notable index empty resulting empty notable dashboards

eegiievol — Wed, 16 Sep 2020 05:44:08 GMT

We are unable to see our notable events when correlation search criteria met. Upon investigation, found out that notable index is empty, which resulting es_notable_events kvstore lookup empty. Correlation search has no issue because we could see other AR actions triggered except notable.

Our environment:
2 indexers with cluster configuration, 1 SH, 1 stack of MC/License master/Deployment server, 1 Cluster Master. ES version: 6.2.0, Enterprise version: 8.0.5

Hope someone can give me a hand

Re: ES notable index empty resulting empty notable dashboards

thambisetty — Wed, 16 Sep 2020 06:15:56 GMT

check the status of kvstore on search head. status should be ready.

| rest splunk_server=local /services/server/info | table kvStoreStatus

Re: ES notable index empty resulting empty notable dashboards

eegiievol — Wed, 16 Sep 2020 06:22:17 GMT

Re: ES notable index empty resulting empty notable dashboards

eegiievol — Mon, 26 Oct 2020 02:30:19 GMT

I found a reason. inputs.conf file was removed while installing CIM app to follow addon installation in distributed environment guide. Some addons are exceptional, I should have read manual carefully.