Splunk Enterprise Security

splunk cloud es notable index empty

Splunk_rocks
Path Finder

Hello Splunkers
we have splunk managed cloud ES and i have enabled all correlation searches as per doc the way we do on Prem ES.
Nothing showing ES posture dashboards and notable events are empty no data under notable index
we mapped data models and we validated data with data model fields every thing is there
but ES and notable index is empty BW this is splunk managed cloud product

0 Karma

woodcock
Esteemed Legend

There are many steps for setting up ES that you should do before enabling correlation searches. On top of that, enabling ALL of them is an absolutely horrible idea and nobody should ever do that. Generally ES is sold with PS and your PS team should know better than that and should have done all the setup. What setup did you do and what documentation did you/they follow for setup?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Splunk Developer Day announcements: AI agents, MCP tools, Forecasting, and Custom ...

Splunk Developer Day was packed with product and platform updates for developers building in the AI ...