About installing Splunk Enterprise Security

[masakazu]

https://docs.splunk.com/Documentation/ES/7.3.2/Install/InstallEnterpriseSecurity

I installed Splunk Enterprise Security to verify operation,
following the above manual, I installed and configured the initial settings.

When I opened the incident view in the app's menu bar,
an error message appeared saying "An error occurred while loading some filters."

When I opened the investigation,
an error message appeared saying "Unknown Error: FAiled to fetch KV Store."

I can't display the incident review and investigation.
Is anyone else experiencing the same issue?

[masakazu]

PickleRick-san
gcusello-san
Thank you for response.

As you pointed out, KVstore did not seem to be working properly.
I reinstalled it with Fips-mode turned off and it worked fine.

Is it impossible to install SplunkES on a Splunk Server running in Fips-mode?

[gcusello]

Hi @masakazu ,

I don't live in US so I never installed Splunk in FIPS Mode, but reading the related documentation ( https://docs.splunk.com/Documentation/Splunk/9.3.2/Security/SecuringSplunkEnterprisewithFIPs ), I don't see any known issue on ES or KV-Store.

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Ciao.

Giuseppe

[PickleRick]

ES depends heavily on kvstore. If - for some reason - your installation didn't complete correctly and your kvstore isn't fully configured it won't run properly. If your kvstore is not running, ES (and much of the "general Splunk") won't run either. But as far as I remember you might get this kind of problems as well if your user simply doesn't have required capabilities and permissions for running ES.

[gcusello]

Hi @masakazu ,

did you followed all the instructions in the above link?

I never exerimented the above issue.

My hint is to repeat all the steps in the installation procedure, checking if you have kv-Store issues in your Splunk installation.

If you don't solve, open a case to Splunk Support.

Ciao.

Giuseppe