ESCU detections do not gather data from the correct federated indexes.

All federated indexes are not added to the amazon_security_lake search macro.

In Splunk Enterprise Security, go to Search and expand the amazon_security_lake macro to verify if all pertinent indexes are available and edit the macro to include any missing indexes. Alternatively, in Splunk Enterprise Security, go to Settings and select Advanced search and then select Search macro to edit the amazon_security_lake macro and add any missing indexes.

For more information on configuring Federated Analytics on Splunk Platform, see the product documentation:

• About Federated Analytics