Paul you my friend are a Rock Star !!! that's exactly what I needed  ... View more

I ranned this and found some clues     | rest splunk_server=local /servicesNS/-/-/saved/searches | table title eai:acl.app eai:acl.owner search | where match(search,"computers.csv") ... View more

thanks Rich I ran those searches in two separate Splunk environments (the lookup is working in one but not in the other) and got this error in both: No results found. Try expanding the time range.   even after expanding the time range to 30 days I get nothing, plus I don't understand what you are having me do, could you explain please    ... View more

alright this one really bothers me because Splunk is saying we MUST have a branded product called Symantec Endpoint Protection enabled in order to configure Enterprise Security Think about it, do you even own this product?     ... View more

I know stop it already, I get it:   so we gonna double up on these     ... View more

ah yup Error occurred attempting to enable SA-AuditAndDataProtection: . ... View more

well now I'm pot committed      ... View more

and more of this  Error occurred attempting to enable SA-AuditAndDataProtection: . ... View more

alright at this point I'm seriously thinking I should have read some sort of a prerequisits doc but:       SA-AuditDataProtection needs to be enabled as well   ... View more

well I did not expect this: 503 Service Unavailable   ... View more

and then it was on to the next error SA-IdentityManagement      ... View more

alright, second verse same as the first, find the SA-NetworkProtection app and Enable it Error occurred attempting to enable SA-NetworkProtection: .   ... View more

one step forward one step back another click another error: SA-NetworkProtection app appears to be disabled       ... View more

ok so I recon that Splunk SA Scientific Python app was just disabled, no biggie, enabled it and pressed on  ... View more

ok the CLI install was succesfull but now the  Splunk Enterprise Security Post-Install Configuration fails with this error, why is this so difficult?     ... View more

next I attempted to install the app using the CLI as per the manual https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Managingappobjects?ref=hk    splunk install app <app_package_filename> -update 1 -auth <username>:<password> ... View more

so I downloaded the latest version of Splunk Enterprise Security and attempted to Install the App from File, only to be greeted with yet another vague error:  splunk-enterprise-security_710.spl         ... View more

"In my case, it worked fine on most indexer peers and its just 3 out of 20 indexers that has this issue."  Ah yes, that sounds like Splunk, ha ha  here's what I would do: stop Splunk delete everything from the splunkd.log start Splunk open up the newly populated splunkd.log start at the top and take your time going through it line by line just quickly glancing what it is doing until it gets to the KVStore part, my money is on a certificate issue  ... View more

please correct me if I am wrong, but I thought per Splunks documentation recommendation they recommend we run the KV Store on Search Heads and not on Peers aka Indexers, I know this does not solve your problem, but maybe it doesn't have to, maybe just run the KV Store on the Search Heads    ... View more

ah thanks Giuseppe so I guess you can't just create a phantom menu item with nothing behind it like I attempted, it has to be a legit dashboard question for you how can I reveal the source code behind the ES navigation page in the Web UI, all it offers me is the graphical slide this box here slide this box there screen  ... View more

thanks Rich that sort of worked, it gave me that graphical layout type of screen, and I could add something from their canned pull down list and that item shows up, but my test one although I can see it on that layout page does not show up in the menu nav   I guess I should not have used ES as an example cause I am actually trying to move a custom item from the ES nav that the previous Splunk Admin added there incorrectly and add it to our home grown custom app nav instead, so why isn't my basic custom app not showing my new item? ... View more