Splunk Enterprise Security

Splunk ESS index does not have any data

graju89
Path Finder

Hi all,

I am new to splunk. I have installed splunk ESS(5.2) on search head. Splunk environment has one search head and three search peers(indexers). After installing the ESS on search head, I am not able to see any data for the indexes created from ESS like whois, threat_activity. Am I missing anything? Do I require any special configuration on search peers or heavy forwarders?

Thanks,

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Many indexes are populated only after correlation searches are enabled. Enable the correlation searches that make sense for your security use cases, and you'll start to see data in those related indexes, such as the notable index or the threat_activity index.

0 Karma

graju89
Path Finder

Correlation search is enabled already. Do I need to install any add-ons on the search peers?

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

ES is made up of add-ons, and if those are not present on the search peers then yes, you will need to distribute them accordingly. These steps are documented: https://docs.splunk.com/Documentation/ES/5.2.0/Install/InstallTechnologyAdd-ons

0 Karma

graju89
Path Finder

Ok. I saw the link already. I will update once I am done.

0 Karma

graju89
Path Finder

@smoir_splunk I installed the add-ons but still no luck.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...