Splunk Enterprise Security

Splunk ESS index does not have any data

graju89
Path Finder

Hi all,

I am new to splunk. I have installed splunk ESS(5.2) on search head. Splunk environment has one search head and three search peers(indexers). After installing the ESS on search head, I am not able to see any data for the indexes created from ESS like whois, threat_activity. Am I missing anything? Do I require any special configuration on search peers or heavy forwarders?

Thanks,

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Many indexes are populated only after correlation searches are enabled. Enable the correlation searches that make sense for your security use cases, and you'll start to see data in those related indexes, such as the notable index or the threat_activity index.

0 Karma

graju89
Path Finder

Correlation search is enabled already. Do I need to install any add-ons on the search peers?

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

ES is made up of add-ons, and if those are not present on the search peers then yes, you will need to distribute them accordingly. These steps are documented: https://docs.splunk.com/Documentation/ES/5.2.0/Install/InstallTechnologyAdd-ons

0 Karma

graju89
Path Finder

Ok. I saw the link already. I will update once I am done.

0 Karma

graju89
Path Finder

@smoir_splunk I installed the add-ons but still no luck.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...