Splunk Security Essentials error

erinbwest · ‎11-06-2020

We recently moved Splunk Security Essentials from our lab to our QA environment, but it is not working. In Lab we have admin privs, but in QA it is only power user privs and we did enable the _list settings permissions for our roles as suggested by another post. It still will not populate. Any other suggestions? Here is the error.

External search command 'sseanalytics' returned error code 1. .

richgalloway · ‎11-06-2020

Check splunkd.log for more information about the cause of the error.

---
If this reply helps you, Karma would be appreciated.

Splunk Security Essentials error

troubleshooting

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

Announcing Modern Navigation: A New Era of Splunk User Experience

Data Drivers: How We're Streaming Real-Time F1 Telemetry Directly into Splunk ...

Join the Conversation

Splunk Security Essentials error

troubleshooting

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

Announcing Modern Navigation: A New Era of Splunk User Experience

Data Drivers: How We're Streaming Real-Time F1 Telemetry Directly into Splunk ...