Splunk Enterprise Security

Splunk Enterprise Security: Dashboards not loading data

New Member

We have a indexer , heavy forwarder, 2 search head , 1 deployment server .
The splunk enterprise Search head dashboards are pulling data and is looking good.
The other search head for enterprise security , dashboards are not pulling data.
I checked the data models are there , apps are updated.
Saw an distributed search alert stating "the rest uri is not connecting as peer status is 2", not sure is it because of that.
However need urgent help how to get at least default Splunk ES dashboards like security posture,incident review etc to show data.
Please share your thoughts

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!