Splunk Enterprise Security

Is there a troubleshooting guide for Enterprise Security or ITSI specifically?

natalienguyen
Explorer

Is there a troubleshooting guide for Enterprise Security or ITSI specifically?

I know that Splunk has a manual for generic troubleshooting, but I'd like on for ES and ITSI specifically.

0 Karma
1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

@natalienguyen, there isn't a specific "troubleshooting guide" for ES, mostly because a lot of troubleshooting ends up concerning specific configurations. You can use much of the generic troubleshooting from the Splunk platform documentation for ES stacks, and then additional troubleshooting guidance is specific to configuration topics:
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootdashboards + http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Dashboardrequirements help you determine why data might not be appearing in dashboards
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Verifythreatintel helps you identify why threat intelligence is or is not appearing in your environment.
App import is an ES-specific configuration, and can be helpful when troubleshooting things like "why isn't this configuration visible in ES but it is in the search app?" http://docs.splunk.com/Documentation/ES/5.1.0/Install/ImportCustomApps
Also information about data models can be found here: http://docs.splunk.com/Documentation/ES/5.1.0/Install/Datamodels as well as in the Knowledge Manager Manual, and also in the Splunk CIM documentation.

Many troubleshooting topics are accessible directly from the "messages" in Splunk Web, and help you resolve specific issues with your deployment:
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootscripterrors
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootdefaultadminsearches
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshoothealthcheck
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootintelligencedownloads

The Inherited Deployments manual may also help provide some pointers: http://docs.splunk.com/Documentation/Splunk/7.1.2/InheritedDeployment/Introduction

View solution in original post

hjauch_splunk
Splunk Employee
Splunk Employee

There is a Troubleshooting chapter in the ITSI Installation and Configuration manual here: http://docs.splunk.com/Documentation/ITSI/3.1.3/Configure/Installationandconfigurationconsiderations...

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

@natalienguyen, there isn't a specific "troubleshooting guide" for ES, mostly because a lot of troubleshooting ends up concerning specific configurations. You can use much of the generic troubleshooting from the Splunk platform documentation for ES stacks, and then additional troubleshooting guidance is specific to configuration topics:
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootdashboards + http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Dashboardrequirements help you determine why data might not be appearing in dashboards
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Verifythreatintel helps you identify why threat intelligence is or is not appearing in your environment.
App import is an ES-specific configuration, and can be helpful when troubleshooting things like "why isn't this configuration visible in ES but it is in the search app?" http://docs.splunk.com/Documentation/ES/5.1.0/Install/ImportCustomApps
Also information about data models can be found here: http://docs.splunk.com/Documentation/ES/5.1.0/Install/Datamodels as well as in the Knowledge Manager Manual, and also in the Splunk CIM documentation.

Many troubleshooting topics are accessible directly from the "messages" in Splunk Web, and help you resolve specific issues with your deployment:
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootscripterrors
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootdefaultadminsearches
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshoothealthcheck
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootintelligencedownloads

The Inherited Deployments manual may also help provide some pointers: http://docs.splunk.com/Documentation/Splunk/7.1.2/InheritedDeployment/Introduction

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...