topic Re: Splunk app (forescout) could not read index in Getting Data In

Splunk app (forescout) could not read index

splunk-newbie — Fri, 27 Nov 2020 14:07:57 GMT

I am getting this error and needs help troubleshooting and resolving the issue:
" App: [ForeScout App for Splunk] could not read index from : [ForeScout Technology Add-on for Splunk]"

Re: Splunk app (forescout) could not read index

isoutamo — Fri, 27 Nov 2020 17:14:54 GMT

Hi
Have you done setup and create needed indexes described here https://www.forescout.com/company/resources/app-and-add-on-for-splunk-how-to-guide-2-9-1/ ?

Re: Splunk app (forescout) could not read index

splunk-newbie — Fri, 27 Nov 2020 17:59:18 GMT

Hi Soutamo,
Everything was working fine until a few days ago. The environment has been pretty steady, and I think something must have changed to cause that error. I just inherited the environment a couple of weeks ago and I need to get this issue resolved asap. Any help will be greatly appreciated.

Re: Splunk app (forescout) could not read index

isoutamo — Fri, 27 Nov 2020 21:22:56 GMT

Check from dashbords, macros, eventtypes which index it should use. Then check that this index exists and it has data and is readable. Look if there is any additional information on internal logs.