Splunk Enterprise Security

notable index not populating events for Splunk enterprise security appurity app

Arun
New Member

Can anyone help me im understanding why the notable events are not getting populated on splunk enterprise security.

Ive reinstalled the enterprise security app to see if that fixs the problem. But no luck.

Also ive enabled the corelation searches that are shipped by default by the app. The CS search returns the event result when explicitly searched but when the scheduled toh run no notable events are generated. I manually tired creating a notable events. still i do not see any of the notable events in security posture or other tabs.

To validate ive checked the notable index (i.e. index="notable") but even the notable index returns 0 events.I tried all but no luck.

Can someone help we you understanding what is causing the issue

0 Karma

scelikok
SplunkTrust
SplunkTrust

@Arun,

If you are using indexer cluster,  you should have create indexes that ES will use on your indexers. notable index is one of these. Could you please check if you may miss this step? 

https://docs.splunk.com/Documentation/ES/6.4.1/Install/Indexes 

If this reply helps you an upvote is appreciated.
0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!