Correlation search not running Enteprise Security App

[burakatabay]

Hi,

Why splunk correlation searches not running on SplunkEnterpriseSecurity App ? but correlation search run another app for example search and reporting app

ES versiyon 6.2.0 Splunk Version 8.0.4

for example : Substantial Increase In Intrusion Events

I upload screenshoot on event.

[anilchaithu]

@burakatabay 

Initial debug is to check app level permissions for this datamodel? Does this datamodel is shared across all the apps?

[burakatabay · Accepted solution]

Thank you for answer.

We found problem in splunk installation phase.

The problem is installation user name is not admin it's anothername.

So App level permission doesn't working. We fix the problem. :+1