Splunk Enterprise Security

Splunk ES Installation and Configuration dashboard error.

rafeeqsid25
New Member

I first time installing ES apps on Splunk Enterprise 7.2.1 with ES version 5.2.0.

Splunk Environment:-
1 SH standalone
3 Indexer in Cluster mode

Installation of ES apps
1.Installation of ES done successfully ,But not able to see any data over ES dashboard.
2.All ES data-models are accelerated.
3.No event is in notable event

0 Karma

woodcock
Esteemed Legend

What do you mean by installing ES apps? Do you mean installing ES? Do you mean installing TAs? Who setup you ES; did you do it yourself or did you get PS?

0 Karma

johnvr
Path Finder

Hey @rafeeqsid25,

I'm assuming by your saying there's no data on the dashboard, there's no data on any of them? Your "all ES datamodels are accelerated" comment kind of tips me off, as it's not too common to see an environment where they all are.

There's kind of a lot to go through here, and I don't know how familiar you are with Splunk or its mechanisms, so I'll start at the baseline.

Do you know if your data is CIM-compliant? You can get an overview of CIM, the Common Information Model, here: https://docs.splunk.com/Documentation/CIM/4.12.0/User/Overview

ES dashboards are populated by searches based - mostly - on the summaries created by accelerated data models. But the acceleration of that data is dependent on the data being normalized to that Common Information Model.

Try this. Datamodel summaries - what model accelerations create - are generated by underlying searches. Those searches look something like this:

`relevant_indexes` tag=relevant

Take any of those models, and run their searches ad-hoc. Do you get results? If not, they're probably not CIM compliant, or you just don't have the data applicable to that model. Or both.

0 Karma

tiagofbmm
Influencer

What ES dashboard? The security posture?

Have you enabled or created correlation searches that have alert actions as create notable events? If not, then you can't expect dashboards based on notables if they don't exist yet.

Let us know

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...