Splunk Enterprise Security

Why does the Splunk App for Enterprise Security trigger audit warnings about system requirements in a virtualized environment?

mbarrie_splunk
Splunk Employee
Splunk Employee

In the Splunk App for Enterprise Security on Splunk Cloud, there is a frequent message that the systems don't meet the minimum requirements for Splunk. The message keeps popping up periodically, even on instances that have plenty of memory and Virtual CPUs.

The actual error message is:
One or more machines does not meet the minimum system requirements

1 Solution

mbarrie_splunk
Splunk Employee
Splunk Employee

Under Data Inputs->Configuration Checker there is a check that periodically runs the "Audit - ES System Requirements" search. On a virtual system this check will often fail since the number of physical CPU's returned by the REST call in the search is 1. The number of virtual cores, not reflected in the REST call, could be sufficient.

I disabled the configuration check to make the messages go away.

View solution in original post

mbarrie_splunk
Splunk Employee
Splunk Employee

Under Data Inputs->Configuration Checker there is a check that periodically runs the "Audit - ES System Requirements" search. On a virtual system this check will often fail since the number of physical CPU's returned by the REST call in the search is 1. The number of virtual cores, not reflected in the REST call, could be sufficient.

I disabled the configuration check to make the messages go away.

Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...