Is there a troubleshooting guide for Enterprise Security or ITSI specifically?

[natalienguyen]

Is there a troubleshooting guide for Enterprise Security or ITSI specifically?

I know that Splunk has a manual for generic troubleshooting, but I'd like on for ES and ITSI specifically.

[hjauch_splunk]

There is a Troubleshooting chapter in the ITSI Installation and Configuration manual here: http://docs.splunk.com/Documentation/ITSI/3.1.3/Configure/Installationandconfigurationconsiderations...

[smoir_splunk · Accepted solution]

@natalienguyen, there isn't a specific "troubleshooting guide" for ES, mostly because a lot of troubleshooting ends up concerning specific configurations. You can use much of the generic troubleshooting from the Splunk platform documentation for ES stacks, and then additional troubleshooting guidance is specific to configuration topics:
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootdashboards + http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Dashboardrequirements help you determine why data might not be appearing in dashboards
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Verifythreatintel helps you identify why threat intelligence is or is not appearing in your environment.
App import is an ES-specific configuration, and can be helpful when troubleshooting things like "why isn't this configuration visible in ES but it is in the search app?" http://docs.splunk.com/Documentation/ES/5.1.0/Install/ImportCustomApps
Also information about data models can be found here: http://docs.splunk.com/Documentation/ES/5.1.0/Install/Datamodels as well as in the Knowledge Manager Manual, and also in the Splunk CIM documentation.

Many troubleshooting topics are accessible directly from the "messages" in Splunk Web, and help you resolve specific issues with your deployment:
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootscripterrors
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootdefaultadminsearches
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshoothealthcheck
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootintelligencedownloads

The Inherited Deployments manual may also help provide some pointers: http://docs.splunk.com/Documentation/Splunk/7.1.2/InheritedDeployment/Introduction

[renjith_nair]

Hi @natalienguyen,

Are these of any help ?
ES
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Troubleshootdashboards
http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Introduction
http://docs.splunk.com/Documentation/ES/5.1.0/User/Overview

ITSI
https://docs.splunk.com/Documentation/ITSICDM/1.0.0/ITSICDM/TroubleshoottheSplunkITSIModuleforContin...
http://docs.splunk.com/Documentation/ITSI/3.1.2/ITSIScenarios/Troubleshootanoutage
http://docs.splunk.com/Documentation/ITSI/3.1.2/Configure/Abouttheproduct
http://docs.splunk.com/Documentation/ITSI/3.1.2/Configure/KeyConcepts
https://www.splunk.com/blog/2017/02/07/everything-you-need-to-know-about-splunk-itsi.html

There are few interesting videos as well.

https://www.splunk.com/en_us/resources/video.FrNGc4YjE6HFZiB5xshcDHTotAOUAFhk.html