Splunk Enterprise Security

Splunk Enterprise Security doesn't show any data

grswdc2
New Member

Hi,

I'm a real Splunk novice, so apologies if this is a silly question. I've installed Splunk Enterprise, and ES in a test lab. Due to security, I'm unable to export any logs from the production network. I downloaded some sample splunk data, which exists when I try and run a search. Within Splunk ES, I'm not able to see any data. A colleague told me I had to tag data for ES to see it, but I'm not really sure what to do. Is anyone able to give me some pointers please?

My steps were install Splunk, import sample data, and then install the Splunk ES app.

Thanks,
Steve

0 Karma
1 Solution

ChrisG
Splunk Employee
Splunk Employee

Splunk Enterprise Security requires significant configuration after you install it. See the installation overview topic in the documentation. The dashboards in Splunk Enterprise Security rely on data models, and the data has to be normalized to the Common Information Model. See Dashboard troubleshooting in the Splunk Enterprise Security User Manual.

If you are a real Splunk novice, this information is going to be hard to follow. Splunk Enterprise Security requires some advanced knowledge to set up and configure!

View solution in original post

ChrisG
Splunk Employee
Splunk Employee

Splunk Enterprise Security requires significant configuration after you install it. See the installation overview topic in the documentation. The dashboards in Splunk Enterprise Security rely on data models, and the data has to be normalized to the Common Information Model. See Dashboard troubleshooting in the Splunk Enterprise Security User Manual.

If you are a real Splunk novice, this information is going to be hard to follow. Splunk Enterprise Security requires some advanced knowledge to set up and configure!

ekost
Splunk Employee
Splunk Employee

Adding to what @ChrisG is saying, getting the data is critical. The CIM compatible add-on's provided with ES and available on splunkbase often include an eventgen.conf file for generating sample data using the eventgen tool (github/splunk/eventgen

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...