topic Splunk Enterprise Security: Why can't I enable the default correlation searches as an admin user? in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212392#M1229 <P>In our Splunk Enterprise Security instance, I can't enable the default correlation searches that come with it.</P> <P>I'm logged as Administrator in Splunk.</P> Tue, 03 Jan 2017 14:44:48 GMT Yaichael 2017-01-03T14:44:48Z Splunk Enterprise Security: Why can't I enable the default correlation searches as an admin user? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212392#M1229 <P>In our Splunk Enterprise Security instance, I can't enable the default correlation searches that come with it.</P> <P>I'm logged as Administrator in Splunk.</P> Tue, 03 Jan 2017 14:44:48 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212392#M1229 Yaichael 2017-01-03T14:44:48Z Re: Splunk Enterprise Security: Why can't I enable the default correlation searches as an admin user? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212393#M1230 <P>Hi,</P> <P>can you provide some details: What's happening when you try to enable them ? Is there an error message ? What version and OS are you running ? Do you have a Splunk license ?</P> Tue, 03 Jan 2017 14:53:47 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212393#M1230 mdessus_splunk 2017-01-03T14:53:47Z Re: Splunk Enterprise Security: Why can't I enable the default correlation searches as an admin user? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212394#M1231 <P>Hi mdessus,</P> <P>Thanks for the reply.</P> <P>In the Actions column of the correlation searches, there is no toggle menu or button to enable the correlation. No, there is no error message being displayed, at least. I'm running ESS v4.5.1 on Windows. Yes, I have a Splunk license.</P> Tue, 03 Jan 2017 15:05:19 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212394#M1231 Yaichael 2017-01-03T15:05:19Z Re: Splunk Enterprise Security: Why can't I enable the default correlation searches as an admin user? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212395#M1232 <P>So, when you go to <EM>ES app / Configure / Content Management</EM>, there is nothing in the Actions column, in any pages ?<BR /> Have you done the ES setup ? <BR /> Do you have any errors when you go to <EM>Settings / Monitoring Console / Health Check</EM> ?<BR /> Any specific errors when you search <EM>index=_</EM>* ?</P> Tue, 03 Jan 2017 15:13:01 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212395#M1232 mdessus_splunk 2017-01-03T15:13:01Z Re: Splunk Enterprise Security: Why can't I enable the default correlation searches as an admin user? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212396#M1233 <P>When I follow the mentioned path, in the Actions column of a correlation search, I can only see the action "Disabled".</P> <P>I did the Splunk Enterprise Security Post-Install Configuration.</P> <P>No, there are no errors in the Monitoring Console.</P> <P>There was a Data Model that wasn't being found, but shared it through all the apps, and that fixed the issue, but other than that, there are no errors.</P> Tue, 03 Jan 2017 17:58:02 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212396#M1233 Yaichael 2017-01-03T17:58:02Z Re: Splunk Enterprise Security: Why can't I enable the default correlation searches as an admin user? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212397#M1234 <P>Hi mdessus,</P> <P>I found the issue. ESS doesn't provide the edit_correlationsearches capability by default to the admin user.</P> <P>Sorry for the bother and thanks for the help.</P> Tue, 03 Jan 2017 19:02:57 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212397#M1234 Yaichael 2017-01-03T19:02:57Z Re: Splunk Enterprise Security: Why can't I enable the default correlation searches as an admin user? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212398#M1235 <P>Hum... it used to !</P> Tue, 03 Jan 2017 21:44:54 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212398#M1235 mdessus_splunk 2017-01-03T21:44:54Z Re: Splunk Enterprise Security: Why can't I enable the default correlation searches as an admin user? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212399#M1236 <P>Umm maybe something went wrong in the installation?</P> Wed, 04 Jan 2017 12:43:21 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212399#M1236 Yaichael 2017-01-04T12:43:21Z Re: Splunk Enterprise Security: Why can't I enable the default correlation searches as an admin user? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212400#M1237 <P>Just to clarify, the ess_admin role gets the edit_correlationsearches capability assignment and the admin role should be inheriting the ess_admin role. </P> Tue, 29 Sep 2020 12:16:14 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212400#M1237 ekost 2020-09-29T12:16:14Z Re: Splunk Enterprise Security: Why can't I enable the default correlation searches as an admin user? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212401#M1238 <P>Thanks for the comment, ekost!</P> Thu, 05 Jan 2017 19:30:19 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Why-can-t-I-enable-the-default/m-p/212401#M1238 Yaichael 2017-01-05T19:30:19Z