Splunk Enterprise Security

Splunk ESS index does not have any data

graju89
Path Finder

Hi all,

I am new to splunk. I have installed splunk ESS(5.2) on search head. Splunk environment has one search head and three search peers(indexers). After installing the ESS on search head, I am not able to see any data for the indexes created from ESS like whois, threat_activity. Am I missing anything? Do I require any special configuration on search peers or heavy forwarders?

Thanks,

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Many indexes are populated only after correlation searches are enabled. Enable the correlation searches that make sense for your security use cases, and you'll start to see data in those related indexes, such as the notable index or the threat_activity index.

0 Karma

graju89
Path Finder

Correlation search is enabled already. Do I need to install any add-ons on the search peers?

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

ES is made up of add-ons, and if those are not present on the search peers then yes, you will need to distribute them accordingly. These steps are documented: https://docs.splunk.com/Documentation/ES/5.2.0/Install/InstallTechnologyAdd-ons

0 Karma

graju89
Path Finder

Ok. I saw the link already. I will update once I am done.

0 Karma

graju89
Path Finder

@smoir_splunk I installed the add-ons but still no luck.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...