Splunk Enterprise Security

Splunk Enterprise Security doesn't show any data

grswdc2
New Member

Hi,

I'm a real Splunk novice, so apologies if this is a silly question. I've installed Splunk Enterprise, and ES in a test lab. Due to security, I'm unable to export any logs from the production network. I downloaded some sample splunk data, which exists when I try and run a search. Within Splunk ES, I'm not able to see any data. A colleague told me I had to tag data for ES to see it, but I'm not really sure what to do. Is anyone able to give me some pointers please?

My steps were install Splunk, import sample data, and then install the Splunk ES app.

Thanks,
Steve

0 Karma
1 Solution

ChrisG
Splunk Employee
Splunk Employee

Splunk Enterprise Security requires significant configuration after you install it. See the installation overview topic in the documentation. The dashboards in Splunk Enterprise Security rely on data models, and the data has to be normalized to the Common Information Model. See Dashboard troubleshooting in the Splunk Enterprise Security User Manual.

If you are a real Splunk novice, this information is going to be hard to follow. Splunk Enterprise Security requires some advanced knowledge to set up and configure!

View solution in original post

ChrisG
Splunk Employee
Splunk Employee

Splunk Enterprise Security requires significant configuration after you install it. See the installation overview topic in the documentation. The dashboards in Splunk Enterprise Security rely on data models, and the data has to be normalized to the Common Information Model. See Dashboard troubleshooting in the Splunk Enterprise Security User Manual.

If you are a real Splunk novice, this information is going to be hard to follow. Splunk Enterprise Security requires some advanced knowledge to set up and configure!

ekost
Splunk Employee
Splunk Employee

Adding to what @ChrisG is saying, getting the data is critical. The CIM compatible add-on's provided with ES and available on splunkbase often include an eventgen.conf file for generating sample data using the eventgen tool (github/splunk/eventgen

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...