Deployment Architecture

About installing Splunk Enterprise Security

masakazu
Explorer

https://docs.splunk.com/Documentation/ES/7.3.2/Install/InstallEnterpriseSecurity

I installed Splunk Enterprise Security to verify operation,
following the above manual, I installed and configured the initial settings.

When I opened the incident view in the app's menu bar,
an error message appeared saying "An error occurred while loading some filters."

When I opened the investigation,
an error message appeared saying "Unknown Error: FAiled to fetch KV Store."

I can't display the incident review and investigation.
Is anyone else experiencing the same issue?

Labels (1)
0 Karma

masakazu
Explorer

PickleRick-san
gcusello-san
Thank you for response.

As you pointed out, KVstore did not seem to be working properly.
I reinstalled it with Fips-mode turned off and it worked fine.

Is it impossible to install SplunkES on a Splunk Server running in Fips-mode?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @masakazu ,

I don't live in US so I never installed Splunk in FIPS Mode, but reading the related documentation ( https://docs.splunk.com/Documentation/Splunk/9.3.2/Security/SecuringSplunkEnterprisewithFIPs ), I don't see any known issue on ES or KV-Store.

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Ciao.

Giuseppe

PickleRick
SplunkTrust
SplunkTrust

ES depends heavily on kvstore. If - for some reason - your installation didn't complete correctly and your kvstore isn't fully configured it won't run properly. If your kvstore is not running, ES (and much of the "general Splunk") won't run either. But as far as I remember you might get this kind of problems as well if your user simply doesn't have required capabilities and permissions for running ES.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @masakazu ,

did you followed all the instructions in the above link?

I never exerimented the above issue.

My hint is to repeat all the steps in the installation procedure, checking if you have kv-Store issues in your Splunk installation.

If you don't solve, open a case to Splunk Support.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...