Splunk Enterprise Security

Splunk Enterprise security search head is not pulling logs from firewall, waf,proxy logs, MFA, sandbox, ...network resources but my other search head for apps is getting all data

RK_sp1unk
New Member

Splunk Enterprise security search head is not pulling logs from firewall, waf,proxy logs, MFA, sandbox, ...network resources however my other search head for apps is getting all data

A distributed architecture with a single instance for 1 indexer, 1 Search Head, 1 Search Head with Enterprise Security, 1 Heavy Forwarder and 1 Deployment server is designed to ensure enhance log search performance. The following are essential components of Distributed Architecture implemented in our setup.

• 1 Search Head with License Master
• 1 Search Head running Enterprise Security App
• 1 Deployment server
• 1 Indexer
• 1 Heavy Forwarder

How can I solve this now, but my ES dashboard like security posture, incident reviews shows data from windows events, logs etc but no network logs

threat intelligence, endpoints, risks, malware, email activity, DNS activity, access, traffic , http, intrusion have not adequate details on firewall,DLP,WAF,MFA,Apex, ....etc

even if i search for user in splunk ES search head normal search no results...

we have all this apps on other search head working fine....we have one indexer peer ....

Need to fix this at priority....please help

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.