Splunk Enterprise Security

Is there a troubleshooting guide for Enterprise Security or ITSI specifically?

Explorer

Is there a troubleshooting guide for Enterprise Security or ITSI specifically?

I know that Splunk has a manual for generic troubleshooting, but I'd like on for ES and ITSI specifically.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

@natalienguyen, there isn't a specific "troubleshooting guide" for ES, mostly because a lot of troubleshooting ends up concerning specific configurations. You can use much of the generic troubleshooting from the Splunk platform documentation for ES stacks, and then additional troubleshooting guidance is specific to configuration topics:
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootdashboards + http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Dashboardrequirements help you determine why data might not be appearing in dashboards
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Verifythreatintel helps you identify why threat intelligence is or is not appearing in your environment.
App import is an ES-specific configuration, and can be helpful when troubleshooting things like "why isn't this configuration visible in ES but it is in the search app?" http://docs.splunk.com/Documentation/ES/5.1.0/Install/ImportCustomApps
Also information about data models can be found here: http://docs.splunk.com/Documentation/ES/5.1.0/Install/Datamodels as well as in the Knowledge Manager Manual, and also in the Splunk CIM documentation.

Many troubleshooting topics are accessible directly from the "messages" in Splunk Web, and help you resolve specific issues with your deployment:
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootscripterrors
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootdefaultadminsearches
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshoothealthcheck
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootintelligencedownloads

The Inherited Deployments manual may also help provide some pointers: http://docs.splunk.com/Documentation/Splunk/7.1.2/InheritedDeployment/Introduction

View solution in original post

Splunk Employee
Splunk Employee

There is a Troubleshooting chapter in the ITSI Installation and Configuration manual here: http://docs.splunk.com/Documentation/ITSI/3.1.3/Configure/Installationandconfigurationconsiderations...

0 Karma

Splunk Employee
Splunk Employee

@natalienguyen, there isn't a specific "troubleshooting guide" for ES, mostly because a lot of troubleshooting ends up concerning specific configurations. You can use much of the generic troubleshooting from the Splunk platform documentation for ES stacks, and then additional troubleshooting guidance is specific to configuration topics:
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootdashboards + http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Dashboardrequirements help you determine why data might not be appearing in dashboards
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Verifythreatintel helps you identify why threat intelligence is or is not appearing in your environment.
App import is an ES-specific configuration, and can be helpful when troubleshooting things like "why isn't this configuration visible in ES but it is in the search app?" http://docs.splunk.com/Documentation/ES/5.1.0/Install/ImportCustomApps
Also information about data models can be found here: http://docs.splunk.com/Documentation/ES/5.1.0/Install/Datamodels as well as in the Knowledge Manager Manual, and also in the Splunk CIM documentation.

Many troubleshooting topics are accessible directly from the "messages" in Splunk Web, and help you resolve specific issues with your deployment:
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootscripterrors
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootdefaultadminsearches
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshoothealthcheck
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootintelligencedownloads

The Inherited Deployments manual may also help provide some pointers: http://docs.splunk.com/Documentation/Splunk/7.1.2/InheritedDeployment/Introduction

View solution in original post