topic Re: Group Ib integration problem in Splunk Enterprise Security

Group Ib integration problem

mana_pk123 — Tue, 12 Nov 2024 06:39:44 GMT

i am trying to integrate group ib with splunk for which i installed the app entered my api key and username from which it redirects to the homepage. but all my dashboards are empty and no indexes are created? how can i troubleshoot or fix it?

Re: Group Ib integration problem

Bhumi — Wed, 13 Nov 2024 12:41:25 GMT

Hi @mana_pk123

Can you please share the link of the application that you installed and trying to integrate ? Is it a Splunkbase application or custom?

Re: Group Ib integration problem

meetmshah — Sun, 24 Nov 2024 10:11:21 GMT

More often than not it would be because of the default macro not being updated - which has information about "in which index the data resides". As @Bhumi suggested, can you share the name of the TA to assist you more?

Re: Group Ib integration problem

PickleRick — Sun, 24 Nov 2024 12:11:36 GMT

Wait a moment. What exactly are you trying to do? Because it sounds as if you were trying to use WebUI to configure... inputs(?) in an app which you installed using WebUI somewhere over a SH cluster.

Or are you doing something else?