https://community.splunk.com/t5/Splunk-Enterprise-Security/splunk-cloud-es-notable-index-empty/m-p/444932#M6053 <P>Hello Splunkers<BR /> we have splunk managed cloud ES and i have enabled all correlation searches as per doc the way we do on Prem ES.<BR /> Nothing showing ES posture dashboards and notable events are empty no data under notable index<BR /> we mapped data models and we validated data with data model fields every thing is there <BR /> but ES and notable index is empty BW this is splunk managed cloud product </P> Wed, 01 May 2019 23:27:36 GMT Splunk_rocks 2019-05-01T23:27:36Z https://community.splunk.com/t5/Splunk-Enterprise-Security/splunk-cloud-es-notable-index-empty/m-p/444932#M6053 <P>Hello Splunkers<BR /> we have splunk managed cloud ES and i have enabled all correlation searches as per doc the way we do on Prem ES.<BR /> Nothing showing ES posture dashboards and notable events are empty no data under notable index<BR /> we mapped data models and we validated data with data model fields every thing is there <BR /> but ES and notable index is empty BW this is splunk managed cloud product </P> Wed, 01 May 2019 23:27:36 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/splunk-cloud-es-notable-index-empty/m-p/444932#M6053 Splunk_rocks 2019-05-01T23:27:36Z https://community.splunk.com/t5/Splunk-Enterprise-Security/splunk-cloud-es-notable-index-empty/m-p/444933#M6054 <P>There are many steps for setting up ES that you should do before enabling correlation searches. On top of that, enabling <STRONG>ALL</STRONG> of them is an absolutely horrible idea and nobody should ever do that. Generally ES is sold with PS and your PS team should know better than that and should have done all the setup. What setup did you do and what documentation did you/they follow for setup?</P> Thu, 02 May 2019 01:15:41 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/splunk-cloud-es-notable-index-empty/m-p/444933#M6054 woodcock 2019-05-02T01:15:41Z