Notable event index is empty.

gl_splunkuser — Fri, 09 Apr 2021 21:25:44 GMT

Hello everyone.

I am trying to deploy ESS, but I having some trouble with the notable events.

I can not see results at the Incident Review dashboard and this is because the notable event index is empty

I created a correlation search and as part of the adaptative response action a notable event had to be create.

But is not working, so I decided to run the search from de alert and there I can see results.

Also I followed the next guide https://docs.splunk.com/Documentation/ES/6.5.0/Admin/Troubleshootnotables

And I found this :

As you can see everything looks ok.

It is important to mention that some searches have been skipped, but not all of them and also I didn't change anything at the Splunk_SA_CIM, read that sometimes that can be a problem, but isn't my case.

Here a let a image of the result of this search index=_internal sourcetype=scheduler

I really don't know what is happening.

I will really appreciate the help.

Regards

Re: Notable event index is empty.

scelikok — Sat, 10 Apr 2021 15:14:46 GMT

Hi @gl_splunkuser,

Is your Splunk standalone or distributed? If your Splunk instance is not standalone, you have to create notable index on your indexers.

Re: Notable event index is empty.

gl_splunkuser — Mon, 12 Apr 2021 01:37:52 GMT

That have a lot of sense.

Thank you so much.

topic Re: Notable event index is empty. in Splunk Search

Notable event index is empty.

Re: Notable event index is empty.

Re: Notable event index is empty.