All Apps and Add-ons

Security Essentials

arlombar
Explorer

I am trying to setup Splunk Security Essentials in a distributed environment on a SHC. I've installed v3.3.2 and all the app was successfully deployed to our search heads however I am having an issue with populating the data inventory. Periodically when we try and enter SPL in for a specific data source and refresh the page the data in input prior will simply disappear. While I see to be able to get around this by adding the input then staying on the page for an extended period in time, all of my data sources that I've added are stuck on the "Analyzing CIM and Event Size" status. I am testing on data sources which have the proper TA's installed for CIM parsing (ex. windows events), but none of my sources are able to get past this stage. Has anyone ever encountered this before or have any suggestions? I don't see any errors in the internal logs coming from the app.

Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...