Splunk ESS index does not have any data

[graju89]

Hi all,

I am new to splunk. I have installed splunk ESS(5.2) on search head. Splunk environment has one search head and three search peers(indexers). After installing the ESS on search head, I am not able to see any data for the indexes created from ESS like whois, threat_activity. Am I missing anything? Do I require any special configuration on search peers or heavy forwarders?

Thanks,

[smoir_splunk]

Many indexes are populated only after correlation searches are enabled. Enable the correlation searches that make sense for your security use cases, and you'll start to see data in those related indexes, such as the notable index or the threat_activity index.

[graju89]

Correlation search is enabled already. Do I need to install any add-ons on the search peers?

[smoir_splunk]

ES is made up of add-ons, and if those are not present on the search peers then yes, you will need to distribute them accordingly. These steps are documented: https://docs.splunk.com/Documentation/ES/5.2.0/Install/InstallTechnologyAdd-ons

[graju89]

Ok. I saw the link already. I will update once I am done.

[graju89]

@smoir_splunk I installed the add-ons but still no luck.