Splunk Enterprise Security

Why does Enterprise Security 3.0 not see the tags or field aliases properly in Splunk 6.0 or 6.1?

Path Finder

I have Splunk Enterprise 6.1, I've had the same issue on 6.0, and Enterprise Security 3.0 running. I pull in a datasource like normal and everything is looking good until I create tags and field aliases. If I create them in the Search and Reporting app, or any other as long as it is not ES, and I share them globally with everyone having read permissions ES does not see the tags. I can search in any app other then ES and the tags work. If I search inside the ES app context with the same search as before it does not produce any results. The field aliases have the same behavior as the tags when searching.

0 Karma


Make sure ES is importing the app properly, see this thread for more info


0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!