https://community.splunk.com/t5/Dashboards-Visualizations/Why-are-most-of-my-Ent-Security-Dashboards-are-blank-How-do-I/m-p/545253#M37444 <P>Thank u for your message. Yes, most of the environment was set up before I started. There are 30 or so datamodels mapped to apps &amp; few 1000 saved searches. But the dashboards all pretty much say no data available!! Please advise. Also advise on how to best use the data models I have. Thank u</P> Thu, 25 Mar 2021 04:00:36 GMT SamHTexas 2021-03-25T04:00:36Z https://community.splunk.com/t5/Dashboards-Visualizations/Why-are-most-of-my-Ent-Security-Dashboards-are-blank-How-do-I/m-p/545232#M37439 <P>Why are most of my Ent. Security Dashboards are blank? How do I open the flood gates of data or events into ES. Matter what options I pick or which dashboard, says no result&nbsp; found. We have a large environment, where are the events &amp; all the goods &amp; incidents?</P> Wed, 24 Mar 2021 22:04:01 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Why-are-most-of-my-Ent-Security-Dashboards-are-blank-How-do-I/m-p/545232#M37439 SamHTexas 2021-03-24T22:04:01Z https://community.splunk.com/t5/Dashboards-Visualizations/Why-are-most-of-my-Ent-Security-Dashboards-are-blank-How-do-I/m-p/545236#M37441 <P>Many ES dashboards are populated by datamodels.&nbsp; Have you set yours up?&nbsp; Have you enabled correlation searches appropriate for your data?&nbsp; Most importantly, is your data CIM-compliant?</P> Wed, 24 Mar 2021 23:24:40 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Why-are-most-of-my-Ent-Security-Dashboards-are-blank-How-do-I/m-p/545236#M37441 richgalloway 2021-03-24T23:24:40Z https://community.splunk.com/t5/Dashboards-Visualizations/Why-are-most-of-my-Ent-Security-Dashboards-are-blank-How-do-I/m-p/545253#M37444 <P>Thank u for your message. Yes, most of the environment was set up before I started. There are 30 or so datamodels mapped to apps &amp; few 1000 saved searches. But the dashboards all pretty much say no data available!! Please advise. Also advise on how to best use the data models I have. Thank u</P> Thu, 25 Mar 2021 04:00:36 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Why-are-most-of-my-Ent-Security-Dashboards-are-blank-How-do-I/m-p/545253#M37444 SamHTexas 2021-03-25T04:00:36Z https://community.splunk.com/t5/Dashboards-Visualizations/Why-are-most-of-my-Ent-Security-Dashboards-are-blank-How-do-I/m-p/545437#M37469 <P>There is no easy answer for this problem.&nbsp; I suspect data was not onboarded to be CIM-compliant so now it can't be found by the datamodels.&nbsp;</P><P>Review an empty dashboard to see what it is trying to find.&nbsp; Verify there is data meeting those requirements (same sourcetype, tags, fields, etc).&nbsp; Add fields, aliases, and tags as necessary for the search to find the data.&nbsp; Avoid modifying the built-in datamodels.</P><P>Repeat for each empty panel.</P> Thu, 25 Mar 2021 15:50:02 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Why-are-most-of-my-Ent-Security-Dashboards-are-blank-How-do-I/m-p/545437#M37469 richgalloway 2021-03-25T15:50:02Z https://community.splunk.com/t5/Dashboards-Visualizations/Why-are-most-of-my-Ent-Security-Dashboards-are-blank-How-do-I/m-p/545767#M37485 <P>Great, it is making a lot of sense. So what role do Lookup tables make in this picture?</P> Sun, 28 Mar 2021 18:50:00 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Why-are-most-of-my-Ent-Security-Dashboards-are-blank-How-do-I/m-p/545767#M37485 SamHTexas 2021-03-28T18:50:00Z https://community.splunk.com/t5/Dashboards-Visualizations/Why-are-most-of-my-Ent-Security-Dashboards-are-blank-How-do-I/m-p/545770#M37486 <P>Lookups enrich data.&nbsp; In ES, they add asset and identity information to notable events in addition to whatever custom enrichments your searches may need.</P><P>I doubt lookups are a cause of your blank dashboards, however.&nbsp; If the lookups were failing then you'd still see *something* on the dashboard.</P> Sun, 28 Mar 2021 19:42:13 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Why-are-most-of-my-Ent-Security-Dashboards-are-blank-How-do-I/m-p/545770#M37486 richgalloway 2021-03-28T19:42:13Z