Splunk Enterprise Security

Splunk ES Installation and Configuration dashboard error.

rafeeqsid25
New Member

I first time installing ES apps on Splunk Enterprise 7.2.1 with ES version 5.2.0.

Splunk Environment:-
1 SH standalone
3 Indexer in Cluster mode

Installation of ES apps
1.Installation of ES done successfully ,But not able to see any data over ES dashboard.
2.All ES data-models are accelerated.
3.No event is in notable event

0 Karma

woodcock
Esteemed Legend

What do you mean by installing ES apps? Do you mean installing ES? Do you mean installing TAs? Who setup you ES; did you do it yourself or did you get PS?

0 Karma

johnvr
Path Finder

Hey @rafeeqsid25,

I'm assuming by your saying there's no data on the dashboard, there's no data on any of them? Your "all ES datamodels are accelerated" comment kind of tips me off, as it's not too common to see an environment where they all are.

There's kind of a lot to go through here, and I don't know how familiar you are with Splunk or its mechanisms, so I'll start at the baseline.

Do you know if your data is CIM-compliant? You can get an overview of CIM, the Common Information Model, here: https://docs.splunk.com/Documentation/CIM/4.12.0/User/Overview

ES dashboards are populated by searches based - mostly - on the summaries created by accelerated data models. But the acceleration of that data is dependent on the data being normalized to that Common Information Model.

Try this. Datamodel summaries - what model accelerations create - are generated by underlying searches. Those searches look something like this:

`relevant_indexes` tag=relevant

Take any of those models, and run their searches ad-hoc. Do you get results? If not, they're probably not CIM compliant, or you just don't have the data applicable to that model. Or both.

0 Karma

tiagofbmm
Influencer

What ES dashboard? The security posture?

Have you enabled or created correlation searches that have alert actions as create notable events? If not, then you can't expect dashboards based on notables if they don't exist yet.

Let us know

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...