Splunk Enterprise Security

Why are the dashboards not displaying any data in the Enterprise Security app?

Explorer

So I recently had to nuke the search head that our Enterprise Security app was running on. I have reinstalled everything and setup search peers but I am having trouble getting any of the dashboards to display any data. Any help with this would be appreciated.

0 Karma

Influencer

The data in the ES dashboards is retrieved from the DataModels residing in your indexers.

The first thing to test is if you can search anything from ma data model, like *| from datamodel:. *. Let me know if you have results for any of the datamodels you are using

0 Karma

Explorer

I get nothing when running that string in search.

0 Karma

Influencer

Are you specifiying one data model?

Like | from datamodel:"Network_Traffic"."All_Traffic"

0 Karma

Motivator

I believe it is like this

| datamodel Authentication search | table Authentication.*
0 Karma

Explorer

Ok, That search returns a ton of results. I have made some progress and have got my identities and assets lists created in ES. Some of the issues I'm having now are:

1. The two lists do not share a common value, so I'm not sure how to merge or if they can even merged

2. When I run a search Asset/Identity Investigator, It returns a lot of bogus PII events. I do have the demo data disabled, So I'm not sure why these events are being labeled as such.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!