Splunk Enterprise Security

Threat Activity in the ES app stopped to populate data


i have recently upgraded SPlunk from 7.1.1 to 7.3.4 and ES from 5.2.2 to 5.3.1, but after the upgrade i can see that the threat activity dashboard does not show any data (data is only available till the time splunk was upgraded)
i can see that the Threat Intelligence Data Model is enabled and accelerated, but when i see "Data Model Audit" it still shows the date and time of the last time for which the dashboard shows data.
Also, i can see that the datamodels Web and network traffic do report data (there are the dependant data models for Threat intelligence data model)
Since its on my prod system, i have not yet tried to rebuild the data model, wanted to know if there is any other possible fix for this.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>