Splunk Enterprise Security

Splunk Enterprise security search head is not pulling logs from firewall, waf,proxy logs, MFA, sandbox, ...network resources but my other search head for apps is getting all data

RK_sp1unk
New Member

Splunk Enterprise security search head is not pulling logs from firewall, waf,proxy logs, MFA, sandbox, ...network resources however my other search head for apps is getting all data

A distributed architecture with a single instance for 1 indexer, 1 Search Head, 1 Search Head with Enterprise Security, 1 Heavy Forwarder and 1 Deployment server is designed to ensure enhance log search performance. The following are essential components of Distributed Architecture implemented in our setup.

• 1 Search Head with License Master
• 1 Search Head running Enterprise Security App
• 1 Deployment server
• 1 Indexer
• 1 Heavy Forwarder

How can I solve this now, but my ES dashboard like security posture, incident reviews shows data from windows events, logs etc but no network logs

threat intelligence, endpoints, risks, malware, email activity, DNS activity, access, traffic , http, intrusion have not adequate details on firewall,DLP,WAF,MFA,Apex, ....etc

even if i search for user in splunk ES search head normal search no results...

we have all this apps on other search head working fine....we have one indexer peer ....

Need to fix this at priority....please help

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...