topic Re: Splunk ESS index does not have any data in Splunk Enterprise Security

Splunk ESS index does not have any data

graju89 — Tue, 13 Nov 2018 19:04:38 GMT

Hi all,

I am new to splunk. I have installed splunk ESS(5.2) on search head. Splunk environment has one search head and three search peers(indexers). After installing the ESS on search head, I am not able to see any data for the indexes created from ESS like whois, threat_activity. Am I missing anything? Do I require any special configuration on search peers or heavy forwarders?

Thanks,

Re: Splunk ESS index does not have any data

smoir_splunk — Tue, 13 Nov 2018 19:36:30 GMT

Many indexes are populated only after correlation searches are enabled. Enable the correlation searches that make sense for your security use cases, and you'll start to see data in those related indexes, such as the notable index or the threat_activity index.

Re: Splunk ESS index does not have any data

graju89 — Tue, 13 Nov 2018 19:41:28 GMT

Correlation search is enabled already. Do I need to install any add-ons on the search peers?

Re: Splunk ESS index does not have any data

smoir_splunk — Tue, 13 Nov 2018 19:43:28 GMT

ES is made up of add-ons, and if those are not present on the search peers then yes, you will need to distribute them accordingly. These steps are documented: https://docs.splunk.com/Documentation/ES/5.2.0/Install/InstallTechnologyAdd-ons

Re: Splunk ESS index does not have any data

graju89 — Tue, 13 Nov 2018 19:48:31 GMT

Ok. I saw the link already. I will update once I am done.

Re: Splunk ESS index does not have any data

graju89 — Tue, 13 Nov 2018 21:04:25 GMT

@smoir_splunk I installed the add-ons but still no luck.