Splunk Enterprise Security

Trouble with Enterprise Security configuration

spodda01da
Path Finder

Hi All,

We have recently installed Enterprise Security but strangely the default dashboard doesn't display the indexes we have in our environment.

Initially I though the indexes are not CIM compliant but it wasn't the case as many of them are.

Unfortunately, I am running out of ideas and need some help configuring it.

Need someone who can help me with it.

Thanks much,

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There is no such thing as CIM-compliance for indexes.  CIM compliance applies to field names (and some values).

To make ES aware of your index names, install your "all_indexes" app on the ES search head.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There is no such thing as CIM-compliance for indexes.  CIM compliance applies to field names (and some values).

To make ES aware of your index names, install your "all_indexes" app on the ES search head.

---
If this reply helps you, Karma would be appreciated.

spodda01da
Path Finder

Thanks @richgalloway , It worked !!

I can see dashboards filled with contents but not sure if ES is able to utilize all indexes.

Are there any links to documentation, videos which will help understand and build correlations & investigations.

richgalloway
SplunkTrust
SplunkTrust

Check out the tutorials at https://docs.splunk.com/Documentation/ES/7.1.0/Tutorials/Overview

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...