topic Re: Splunk ES Installation and Configuration dashboard error. in Splunk Enterprise Security

Splunk ES Installation and Configuration dashboard error.

rafeeqsid25 — Sat, 02 Mar 2019 21:54:02 GMT

I first time installing ES apps on Splunk Enterprise 7.2.1 with ES version 5.2.0.

Splunk Environment:-
1 SH standalone
3 Indexer in Cluster mode

Installation of ES apps
1.Installation of ES done successfully ,But not able to see any data over ES dashboard.
2.All ES data-models are accelerated.
3.No event is in notable event

Re: Splunk ES Installation and Configuration dashboard error.

tiagofbmm — Sat, 02 Mar 2019 22:18:35 GMT

What ES dashboard? The security posture?

Have you enabled or created correlation searches that have alert actions as create notable events? If not, then you can't expect dashboards based on notables if they don't exist yet.

Let us know

Re: Splunk ES Installation and Configuration dashboard error.

johnvr — Sun, 03 Mar 2019 04:29:29 GMT

Hey @rafeeqsid25,

I'm assuming by your saying there's no data on the dashboard, there's no data on any of them? Your "all ES datamodels are accelerated" comment kind of tips me off, as it's not too common to see an environment where they all are.

There's kind of a lot to go through here, and I don't know how familiar you are with Splunk or its mechanisms, so I'll start at the baseline.

Do you know if your data is CIM-compliant? You can get an overview of CIM, the Common Information Model, here: https://docs.splunk.com/Documentation/CIM/4.12.0/User/Overview

ES dashboards are populated by searches based - mostly - on the summaries created by accelerated data models. But the acceleration of that data is dependent on the data being normalized to that Common Information Model.

Try this. Datamodel summaries - what model accelerations create - are generated by underlying searches. Those searches look something like this:

`relevant_indexes` tag=relevant

Take any of those models, and run their searches ad-hoc. Do you get results? If not, they're probably not CIM compliant, or you just don't have the data applicable to that model. Or both.

Re: Splunk ES Installation and Configuration dashboard error.

woodcock — Sun, 03 Mar 2019 04:56:49 GMT

What do you mean by installing ES apps? Do you mean installing ES? Do you mean installing TAs? Who setup you ES; did you do it yourself or did you get PS?