Splunk Enterprise Security

Why does Enterprise Security 3.0 not see the tags or field aliases properly in Splunk 6.0 or 6.1?

chrishatfield21
Path Finder

I have Splunk Enterprise 6.1, I've had the same issue on 6.0, and Enterprise Security 3.0 running. I pull in a datasource like normal and everything is looking good until I create tags and field aliases. If I create them in the Search and Reporting app, or any other as long as it is not ES, and I share them globally with everyone having read permissions ES does not see the tags. I can search in any app other then ES and the tags work. If I search inside the ES app context with the same search as before it does not produce any results. The field aliases have the same behavior as the tags when searching.

0 Karma

derekarnold
Communicator

Make sure ES is importing the app properly, see this thread for more info

http://docs.splunk.com/Documentation/ES/3.3.0/Install/InstallTechnologyAdd-ons#Add_a_custom_add-on_t...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...