How do I set up the Enterprise Security (ES) app search context

[aweitzman]

I'm trying to get some data to show up in the Enterprise Security 3.3 app on Splunk 6.2.3 on Windows, and it seems like it doesn't have the right search context.

For instance, when I generate the pivot table that emanates from the "Alerts" data model (where does this show up in the ES dashboard, by the way?), which executes in the ES app context, I get 0 results. When I do the exact same search from the main Search app context, though, I get 7.

What's missing from my setup?

Thank you.

[domenico_perre]

Sounds like it might be the default indexes that your user is searching. When you setup ES. You would have assigned a role to the ES user. What are the default indexes that are searched?

Also if you enable the correlation searches under custom searches your incident dashboard will start populating.

[amo_87]

Hi,

I have also the same issue with my Splunk ES search context configuration.
Is there a solution to populate tag value during search phase in ES search context ?

Thank in advance