Splunk Security Essentials error

erinbwest · ‎11-06-2020

We recently moved Splunk Security Essentials from our lab to our QA environment, but it is not working. In Lab we have admin privs, but in QA it is only power user privs and we did enable the _list settings permissions for our roles as suggested by another post. It still will not populate. Any other suggestions? Here is the error.

External search command 'sseanalytics' returned error code 1. .

richgalloway · ‎11-06-2020

Check splunkd.log for more information about the cause of the error.

---
If this reply helps you, Karma would be appreciated.

Splunk Security Essentials error

troubleshooting

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: State of Observability - Where AI Meets Performance

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Join the Conversation

Splunk Security Essentials error

troubleshooting

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: State of Observability - Where AI Meets Performance

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose