Splunk Enterprise Security

Why does the Splunk App for Enterprise Security trigger audit warnings about system requirements in a virtualized environment?

mbarrie_splunk
Splunk Employee
Splunk Employee

In the Splunk App for Enterprise Security on Splunk Cloud, there is a frequent message that the systems don't meet the minimum requirements for Splunk. The message keeps popping up periodically, even on instances that have plenty of memory and Virtual CPUs.

The actual error message is:
One or more machines does not meet the minimum system requirements

1 Solution

mbarrie_splunk
Splunk Employee
Splunk Employee

Under Data Inputs->Configuration Checker there is a check that periodically runs the "Audit - ES System Requirements" search. On a virtual system this check will often fail since the number of physical CPU's returned by the REST call in the search is 1. The number of virtual cores, not reflected in the REST call, could be sufficient.

I disabled the configuration check to make the messages go away.

View solution in original post

mbarrie_splunk
Splunk Employee
Splunk Employee

Under Data Inputs->Configuration Checker there is a check that periodically runs the "Audit - ES System Requirements" search. On a virtual system this check will often fail since the number of physical CPU's returned by the REST call in the search is 1. The number of virtual cores, not reflected in the REST call, could be sufficient.

I disabled the configuration check to make the messages go away.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...