I added specifically the index, still having same issue I noticed the below as well ""App configuration The "Splunk Common Information Model" app has not been fully configured yet.This app has configuration properties that can be customized for this Splunk instance. Depending on the app, these properties may or may not be required."" but not sure how to proceed already index was added and some data models were accelerated, i only have same button not a next or proceed button   ... View more

at the same time i have a message The search "Network - Traffic Volume Per 30m - Model Gen" is related to the correlation search "Network - Unusual Volume of Network Activity - Rule" but it is not enabled even though the correlation search is; this will cause the correlation to fail   ... View more

when i access a data model (authentication for example) I noticed the below shown error "This object has no explicit index constraint. Consider adding one for better performance." ... View more

Thank @gcusello for your response i edited that in all cases, but the notable was already created so no problem if continous or real time or even if the trigger>1 what do you think regarding incident review page? ... View more

can you elaborate more regarding this point  "you should check if the population scheduled searches are running and if they have results" How i can check it? i installed CIM 5.2.0 and yes i installed TA-addons but not sure about compatibility, do you recommend download to 4.x? ... View more

kindly find the screenshot for the full correlation search and notable configuration ... View more

yes exactly the same, the only different they used deep search but i didn't Noting that notable already exist so the trigger is working and the response is working by creating a notable The severity is high for this notable Any other advice? ... View more

ok much clear, i have cisco switches, tried to search for that Add-on but with no luck. I can see cisco ESA, WSA, ISE ... but not IOS as switches or routers? Moreover, installation tab is empty they are not includes the installation steps any advise here? ... View more

So if i have 50 devices i need to install the TA on all 50? lets assume cisco, fortinet, palo alto ... So its not enough installing TA on idexers and already such devices are sending the logs to the indexer? ... View more

can u share the TA UF, specifically used for ES? Or the download link or any helpful screenshot ... View more

I appreciate all your efforts, Now to make things clear, 1- Does i need to install TA Add-on on UF regarding ES? (yes or no) noting that all my values on the security posture dashboard still zero although i enabled all correlation searches 2- If yes i need on UF, from where i can download it? noting that i didn't find any TA on splunkbase thanks once again ... View more

https://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall   here is the correct link no one mentioned that it is the same TA for both, did you tried this before? As per documentation it should be downloaded directly from splunkbase, but can't find it. The only thing i found is "Splunk-add-on-for-windows" but not sure if that's it or not thanks ... View more

i am using splunk fully on prem - no cloud option as per documentation TA to be installed on UF, you can refer to below link https://community.splunk.com/t5/Security/Universal-Forwarder-Technology-Add-On/m-p/669359#M17403 As i understood, TA to be installed on Indexers (already done) and on UF   Thanks ... View more