Splunk Enterprise Security

notable index not populating events for Splunk enterprise security appurity app

Arun
Observer

Can anyone help me im understanding why the notable events are not getting populated on splunk enterprise security.

Ive reinstalled the enterprise security app to see if that fixs the problem. But no luck.

Also ive enabled the corelation searches that are shipped by default by the app. The CS search returns the event result when explicitly searched but when the scheduled toh run no notable events are generated. I manually tired creating a notable events. still i do not see any of the notable events in security posture or other tabs.

To validate ive checked the notable index (i.e. index="notable") but even the notable index returns 0 events.I tried all but no luck.

Can someone help we you understanding what is causing the issue

0 Karma

scelikok
SplunkTrust
SplunkTrust

@Arun,

If you are using indexer cluster,  you should have create indexes that ES will use on your indexers. notable index is one of these. Could you please check if you may miss this step? 

https://docs.splunk.com/Documentation/ES/6.4.1/Install/Indexes 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...