Enterprise Security installation - index=notable not there after installation

[ques_splunk]

Hello, 

I did the splunk ES installation following all the steps noted here - https://docs.splunk.com/Documentation/ES/7.3.2/Install/InstallEnterpriseSecurity

i did all the steps and now when trying to find those index, even on the /opt/splunk/etc/apps/SplunkEnterpriseSecuritSuite/local or default and there is no indexes.conf, with in them


I am trying to find index=notable, notable_summary, risk to see notable events from correlation search 

How am i supposed to get these indexes in apps inside ES, like shown here as well. 
https://docs.splunk.com/Documentation/ES/7.3.2/Install/Indexes

Any help would be appreciated

[gcusello · Accepted solution]

Hi @ques_splunk ,

as you can read at https://docs.splunk.com/Documentation/ES/7.3.2/Install/InstallEnterpriseSecurity and as @PickleRick said, all the indexes for ES arwe contained in a TA that you can download from the configre menu.

Then you have to install this add-on on the Indexers or on the same machine depending on your architecture.

Ciao.

Giuseppe

[ques_splunk]

Also to ask this, all the indexes referred here in this doc, 
https://docs.splunk.com/Documentation/ES/7.3.2/Install/Indexes

Under specific app, are these apps installed when I install ES, and also after installing SPlunk_TA_FORIndexers, will I have access to all this indexes listed above . 

How are the apps associated there installed on my all-in-one instance, are the apps above isntalled when I installed ES and the indexes are installed when i install the TA? 

This just has my head confused a bit, thank you for answering all this!

[gcusello]

Hi @ques_splunk ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[ques_splunk]

Hello @gcusello , 

Yes I have one machine running the splunk server, not a complex deployment one search head. 

So from my understanding, just deploying the TA-ForIndexers will let me have index=notable, notable_summary and risk? 

I dont want to change any settings for the this TA, just a vanilla download. is there any video guide that shows this if there is it would be really helpful! 

Thank you again!

[PickleRick]

What is your environment architecture? All-in-one? Separate simple indexer tier? Clustered indexer tier?

If your indexers are a separate tier, have you deployed the "for-indexer" TA?

[ques_splunk]

I have one server with installation for it of splunk on it, 

Just to confirm @PickleRick , installing the Splunk_TA_forIndexers will have the those indexes installed? 

also any correlation search that has notable event action will be get indexed under index=notable? 

Am i getting this right?

Thank you so much for all the help!

[ques_splunk]

Hello @PickleRick , 

Sorry forgot to answer your question, 

Yes, its all -in-one config for my splunk deployment on one machine

[PickleRick]

No, in an all-in-one setup you don't have to separately install the for_indexers addon. It's used if you have multi-tier environment because you then install the main ES app on search head(s) which means you don't have indexes defined on the indexer tier. But in an all-in-one installation you install the ES app on the component working as both indexer and search head so the indexes should be created during installation.

The indexes themselves (the data directories) should be in the same place as all the other indexers so by default it would be /opt/splunk/var/lib/splunk

If you want to see where are the configs that define notable index run

spluni btool index list notable --debug