Splunk Enterprise Security doesn't show any data

[grswdc2]

Hi,

I'm a real Splunk novice, so apologies if this is a silly question. I've installed Splunk Enterprise, and ES in a test lab. Due to security, I'm unable to export any logs from the production network. I downloaded some sample splunk data, which exists when I try and run a search. Within Splunk ES, I'm not able to see any data. A colleague told me I had to tag data for ES to see it, but I'm not really sure what to do. Is anyone able to give me some pointers please?

My steps were install Splunk, import sample data, and then install the Splunk ES app.

Thanks,
Steve

[ChrisG · Accepted solution]

Splunk Enterprise Security requires significant configuration after you install it. See the installation overview topic in the documentation. The dashboards in Splunk Enterprise Security rely on data models, and the data has to be normalized to the Common Information Model. See Dashboard troubleshooting in the Splunk Enterprise Security User Manual.

If you are a real Splunk novice, this information is going to be hard to follow. Splunk Enterprise Security requires some advanced knowledge to set up and configure!

[ekost]

Adding to what @ChrisG is saying, getting the data is critical. The CIM compatible add-on's provided with ES and available on splunkbase often include an eventgen.conf file for generating sample data using the eventgen tool (github/splunk/eventgen