Troubleshoot your deployment
This section provides tips for troubleshooting possible issues with your Splunk App for PCI Compliance deployment.
Other required apps
Splunk platform implements some of its functionality through separate apps. Do not disable any of these apps:
learned
search
launcher
user-prefs
General performance
Where appropriate, you can improve performance of the Splunk App for PCI Compliance and reduce hardware requirements by limiting the indexes used by the app.
If the Splunk App for PCI Compliance is limited to a subset of indexes, all of the indexes it searches require admin access, as described in Set up multiple indexes in Managing Indexers and Clusters of Indexers.
By default the search head searches the "main" index.
Measuring system performance
You can use IOZone on Windows to measure system performance. IOzone will output the data in IOPS if the "-O" argument is specified.
Below is an example of IOzone invocation to store results in an Excel spreadsheet with IOPS:
iozone -s 4g -r 2k -r 4k -r 8k -r 16k -r 32k -O -b results.xls
Performance on UNIX systems
The search head that is hosting the Splunk App for PCI Compliance should be configured for high performance. UNIX systems should check the ulimit
setting in particular, as this can artificially limit the operating system's capacity.
Other performance impacts include the Linux swappiness
setting. Consult with your UNIX systems administrator for high performance build recommendations.
Other troubleshooting tips
- Verify that you have the minimum version of Splunk Enterprise installed. See Install Prerequisites in this manual for more information.
- Disable other apps on the search head you are using for the Splunk App for PCI Compliance. If you are using Splunk add-ons for Cisco, disable the saved searches. See the FAQ for details.
- If you upgrade to PCI 4.4.0 and your notable events are no longer showing up, make sure the correlation searches that are relevant to your use cases for PCI are enabled and recreate the notable events. See Enable correlation searches and Create a notable event.
Upgrade the Splunk App for PCI Compliance | FAQ |
This documentation applies to the following versions of Splunk® App for PCI Compliance: 5.0.1, 5.0.2, 5.1.0, 5.1.1, 5.1.2, 5.2.0, 5.3.0, 5.3.1, 5.3.2
Feedback submitted, thanks!