Installation

Enterprise Security installation - index=notable not there after installation

ques_splunk
Explorer

Hello, 

I did the splunk ES installation following all the steps noted here - https://docs.splunk.com/Documentation/ES/7.3.2/Install/InstallEnterpriseSecurity

i did all the steps and now when trying to find those index, even on the /opt/splunk/etc/apps/SplunkEnterpriseSecuritSuite/local or default and there is no indexes.conf, with in them


I am trying to find index=notable, notable_summary, risk to see notable events from correlation search 

How am i supposed to get these indexes in apps inside ES, like shown here as well. 
https://docs.splunk.com/Documentation/ES/7.3.2/Install/Indexes

Any help would be appreciated

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ques_splunk ,

as you can read at https://docs.splunk.com/Documentation/ES/7.3.2/Install/InstallEnterpriseSecurity and as @PickleRick said, all the indexes for ES arwe contained in a TA that you can download from the configre menu.

Then you have to install this add-on on the Indexers or on the same machine depending on your architecture.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @ques_splunk ,

as you can read at https://docs.splunk.com/Documentation/ES/7.3.2/Install/InstallEnterpriseSecurity and as @PickleRick said, all the indexes for ES arwe contained in a TA that you can download from the configre menu.

Then you have to install this add-on on the Indexers or on the same machine depending on your architecture.

Ciao.

Giuseppe

ques_splunk
Explorer

Also to ask this, all the indexes referred here in this doc, 
https://docs.splunk.com/Documentation/ES/7.3.2/Install/Indexes

Under specific app, are these apps installed when I install ES, and also after installing SPlunk_TA_FORIndexers, will I have access to all this indexes listed above . 

How are the apps associated there installed on my all-in-one instance, are the apps above isntalled when I installed ES and the indexes are installed when i install the TA? 

This just has my head confused a bit, thank you for answering all this!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ques_splunk ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

ques_splunk
Explorer

Hello @gcusello , 

Yes I have one machine running the splunk server, not a complex deployment one search head. 

So from my understanding, just deploying the TA-ForIndexers will let me have index=notable, notable_summary and risk? 

I dont want to change any settings for the this TA, just a vanilla download. is there any video guide that shows this if there is it would be really helpful! 

Thank you again!

0 Karma

PickleRick
SplunkTrust
SplunkTrust

What is your environment architecture? All-in-one? Separate simple indexer tier? Clustered indexer tier?

If your indexers are a separate tier, have you deployed the "for-indexer" TA?

ques_splunk
Explorer

I have one server with installation for it of splunk on it, 

Just to confirm @PickleRick , installing the Splunk_TA_forIndexers will have the those indexes installed? 

also any correlation search that has notable event action will be get indexed under index=notable? 

Am i getting this right?

Thank you so much for all the help!

0 Karma

ques_splunk
Explorer

Hello @PickleRick , 

Sorry forgot to answer your question, 

Yes, its all -in-one config for my splunk deployment on one machine

0 Karma

PickleRick
SplunkTrust
SplunkTrust

No, in an all-in-one setup you don't have to separately install the for_indexers addon. It's used if you have multi-tier environment because you then install the main ES app on search head(s) which means you don't have indexes defined on the indexer tier. But in an all-in-one installation you install the ES app on the component working as both indexer and search head so the indexes should be created during installation.

The indexes themselves (the data directories) should be in the same place as all the other indexers so by default it would be /opt/splunk/var/lib/splunk

If you want to see where are the configs that define notable index run

spluni btool index list notable --debug

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...