Splunk Enterprise Security

Is there a troubleshooting guide for Enterprise Security or ITSI specifically?

natalienguyen
Explorer

Is there a troubleshooting guide for Enterprise Security or ITSI specifically?

I know that Splunk has a manual for generic troubleshooting, but I'd like on for ES and ITSI specifically.

0 Karma
1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

@natalienguyen, there isn't a specific "troubleshooting guide" for ES, mostly because a lot of troubleshooting ends up concerning specific configurations. You can use much of the generic troubleshooting from the Splunk platform documentation for ES stacks, and then additional troubleshooting guidance is specific to configuration topics:
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootdashboards + http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Dashboardrequirements help you determine why data might not be appearing in dashboards
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Verifythreatintel helps you identify why threat intelligence is or is not appearing in your environment.
App import is an ES-specific configuration, and can be helpful when troubleshooting things like "why isn't this configuration visible in ES but it is in the search app?" http://docs.splunk.com/Documentation/ES/5.1.0/Install/ImportCustomApps
Also information about data models can be found here: http://docs.splunk.com/Documentation/ES/5.1.0/Install/Datamodels as well as in the Knowledge Manager Manual, and also in the Splunk CIM documentation.

Many troubleshooting topics are accessible directly from the "messages" in Splunk Web, and help you resolve specific issues with your deployment:
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootscripterrors
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootdefaultadminsearches
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshoothealthcheck
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootintelligencedownloads

The Inherited Deployments manual may also help provide some pointers: http://docs.splunk.com/Documentation/Splunk/7.1.2/InheritedDeployment/Introduction

View solution in original post

hjauch_splunk
Splunk Employee
Splunk Employee

There is a Troubleshooting chapter in the ITSI Installation and Configuration manual here: http://docs.splunk.com/Documentation/ITSI/3.1.3/Configure/Installationandconfigurationconsiderations...

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

@natalienguyen, there isn't a specific "troubleshooting guide" for ES, mostly because a lot of troubleshooting ends up concerning specific configurations. You can use much of the generic troubleshooting from the Splunk platform documentation for ES stacks, and then additional troubleshooting guidance is specific to configuration topics:
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootdashboards + http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Dashboardrequirements help you determine why data might not be appearing in dashboards
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Verifythreatintel helps you identify why threat intelligence is or is not appearing in your environment.
App import is an ES-specific configuration, and can be helpful when troubleshooting things like "why isn't this configuration visible in ES but it is in the search app?" http://docs.splunk.com/Documentation/ES/5.1.0/Install/ImportCustomApps
Also information about data models can be found here: http://docs.splunk.com/Documentation/ES/5.1.0/Install/Datamodels as well as in the Knowledge Manager Manual, and also in the Splunk CIM documentation.

Many troubleshooting topics are accessible directly from the "messages" in Splunk Web, and help you resolve specific issues with your deployment:
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootscripterrors
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootdefaultadminsearches
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshoothealthcheck
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootintelligencedownloads

The Inherited Deployments manual may also help provide some pointers: http://docs.splunk.com/Documentation/Splunk/7.1.2/InheritedDeployment/Introduction

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...