Trouble with Enterprise Security configuration

[spodda01da]

Hi All,

We have recently installed Enterprise Security but strangely the default dashboard doesn't display the indexes we have in our environment.

Initially I though the indexes are not CIM compliant but it wasn't the case as many of them are.

Unfortunately, I am running out of ideas and need some help configuring it.

Need someone who can help me with it.

Thanks much,

[richgalloway · Accepted solution]

There is no such thing as CIM-compliance for indexes.  CIM compliance applies to field names (and some values).

To make ES aware of your index names, install your "all_indexes" app on the ES search head.

[spodda01da]

Thanks @richgalloway , It worked !!

I can see dashboards filled with contents but not sure if ES is able to utilize all indexes.

Are there any links to documentation, videos which will help understand and build correlations & investigations.

[richgalloway]

Check out the tutorials at https://docs.splunk.com/Documentation/ES/7.1.0/Tutorials/Overview