Splunk Search

Notable event index is empty.

gl_splunkuser
Path Finder

Hello everyone.

I am trying to deploy ESS, but I having some trouble with the notable events.

I can not see results at the Incident Review dashboard and this is because the notable event index is empty

gl_splunkuser_0-1618001686453.png

I created a correlation search  and as part of the adaptative response action a notable event had to be create.

But is not working, so I decided to run the search from de alert and there I can see results. 

Also I followed the next guide  https://docs.splunk.com/Documentation/ES/6.5.0/Admin/Troubleshootnotables 

And I found this :

gl_splunkuser_1-1618002078274.png gl_splunkuser_2-1618002108062.png

gl_splunkuser_3-1618002139521.png

As you can see everything looks ok. 

It is important to mention that some searches have been skipped, but not all of them and also I didn't change anything at the Splunk_SA_CIM, read that sometimes that can be a problem, but isn't my case.

Here a let a image of the result of this search index=_internal sourcetype=scheduler

gl_splunkuser_0-1618002915053.png

 

I really don't know what is happening.

 

I will really appreciate the help.

Regards

 

 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @gl_splunkuser,

Is your Splunk standalone or distributed? If your Splunk instance is not standalone, you have to create notable index on your indexers. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

gl_splunkuser
Path Finder

That have a lot of sense.

Thank you so much.

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @gl_splunkuser,

Is your Splunk standalone or distributed? If your Splunk instance is not standalone, you have to create notable index on your indexers. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...