Getting Data In

Splunk app (forescout) could not read index

splunk-newbie
Loves-to-Learn

I am getting this error and needs help troubleshooting and resolving the issue: 
" App: [ForeScout App for Splunk] could not read index from : [ForeScout Technology Add-on for Splunk]"

 

Labels (2)
Tags (1)
0 Karma

splunk-newbie
Loves-to-Learn

Hi Soutamo,
Everything was working fine until a few days ago. The environment has been pretty steady, and I think something must have changed to cause that error. I just inherited the environment a couple of weeks ago and I need to get this issue resolved asap. Any help will be greatly appreciated.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Check from dashbords, macros, eventtypes which index it should use. Then check that this index exists and it has data and is readable. Look if there is any additional information on internal logs.
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
Have you done setup and create needed indexes described here https://www.forescout.com/company/resources/app-and-add-on-for-splunk-how-to-guide-2-9-1/ ?
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...