topic Re: How to get support for the Splunk App for Web Analytics? in All Apps and Add-ons

How to get support for the Splunk App for Web Analytics?

dglass0215 — Tue, 28 Apr 2015 13:32:45 GMT

Other than this question/answer forum, Is there a way to get support for the Splunk App for Web Analytics? I have not been able to get it to show any data.

Thanks!

Re: How to get support for the Splunk App for Web Analytics?

aweitzman — Tue, 28 Apr 2015 13:50:45 GMT

I think this forum is it. The app page specifically says "Community Supported."

Re: How to get support for the Splunk App for Web Analytics?

dglass0215 — Tue, 28 Apr 2015 13:53:55 GMT

Well that is a shame because it doesn't sound like there are too many users who have been able to get it to work.

Re: How to get support for the Splunk App for Web Analytics?

jbjerke_splunk — Tue, 28 Apr 2015 15:03:32 GMT

Hi dglass2015

You can use this forum or by clicking my name under the "Built by..." on the right hand side column on the app page.

It's difficult to say what the problem might be without any details. In your other post you mention Splunk TA for Web logs. That TA does not do any data inputs and does not need to be configured at all. It just needs to be installed.

Do you get any results for this search query?

tag=web

If you do, verify that the data model has been accelerated.

If not, do you get anything for this query?

index=* (sourcetype=access* OR sourcetype=iis)

If not, the sourcetype for the data you have in Splunk is not according to the documentation. You can use sourcetype renaming, reimporting the data under a new sourcetype, or by modifying the eventtype definition.

If you let me know more details I can try and help.

Re: How to get support for the Splunk App for Web Analytics?

jbjerke_splunk — Tue, 28 Apr 2015 15:12:49 GMT

I cross posted this to the original post here:
http://answers.splunk.com/answers/231174/splunk-app-for-web-analytics-has-no-data.html

Re: How to get support for the Splunk App for Web Analytics?

dglass0215 — Tue, 28 Apr 2015 15:30:21 GMT

Hi J!

Thanks for your reply. I do get results when searching tag=web and the Data Model named Web is accelerated. What other details can I provide to you?

Thanks!

Re: How to get support for the Splunk App for Web Analytics?

dglass0215 — Tue, 28 Apr 2015 16:35:08 GMT

Some more information for you:

Under Setup -> Websites I have configured a website with Source=W3SVC1

Under Setup -> Lookups -> Generate User Sessions it returns data but Generate Pages does not return data.

Re: How to get support for the Splunk App for Web Analytics?

jbjerke_splunk — Tue, 28 Apr 2015 16:44:20 GMT

That leads me to believe the sites are not correctly setup. Make sure that both the source and the host field match exactly whatever you have in your data. I designed the Website setup page so you can click on the right hand side for all available host+source combinations and then enter the site name without needing to type anything. The source for an IIS site should be a complete folder structure string and not just W3SVC1.

Once this is done, run the lookups again.

Once the lookups are done, rebuild the data model by disabling acceleration and then re-enabling it.

Re: How to get support for the Splunk App for Web Analytics?

dglass0215 — Mon, 28 Sep 2020 19:42:00 GMT

I meant to say that the source was W3SVC1 (surrounded with * at beginning and end. The post is just not displaying the star).

Either way, I Changed the source to C:\inetpub\logs\LogFiles\W3SVC1* (Slashes are being stripped out from this path)

This is not exactly what is listed in the Available host and source combinations as this lists a different source for each different day of IIS logs. Source Examples:

C:\inetpub\logs\LogFiles\W3SVC1\u_ex140630.log
C:\inetpub\logs\LogFiles\W3SVC1\u_ex140701.log
(Slashes are being stripped out from these paths)

etc.

Then I ran lookups again (Generate User Sessions still looks like it returns no results). Then I rebuilt the data moidel. Still no dice.

Again, Thanks for your continued assistance!

Re: How to get support for the Splunk App for Web Analytics?

dglass0215 — Wed, 29 Apr 2015 15:01:37 GMT

Any other assistance you can provide?

Re: How to get support for the Splunk App for Web Analytics?

jbjerke_splunk — Wed, 29 Apr 2015 15:14:05 GMT

Hi again

I found a bug in a config file.

Edit the file transforms.conf in this folder
/etc/apps/SplunkAppForWebAnalytics/default

Edit the stanza so it matches this

[WA_settings]
filename = WA_settings.csv
match_type = WILDCARD(source)

This will enable wildcard matching on the source field so you can have * in the source field in WA_settings.csv . I will shortly release an updated version of the app that has this enabled by default.

In WA_settings.csv:

C:\inetpub\logs\LogFiles\W3SVC1*

Re: How to get support for the Splunk App for Web Analytics?

dglass0215 — Wed, 29 Apr 2015 15:54:03 GMT

Excellent! Thank you very much! I now am able to see data in the real-Time but the rest still shows no data. I have disabled and re-enabled acceleration on the data model and have waited more than 20 minutes. Is there anything else I need to do in order to see data on the other tabs?

Re: How to get support for the Splunk App for Web Analytics?

jbjerke_splunk — Wed, 29 Apr 2015 16:00:40 GMT

Make sure you re-run both lookups - they should both return results - and then disable and re-enable the data model acceleration for the data model Web.

Let me know how you get along.

Re: How to get support for the Splunk App for Web Analytics?

dglass0215 — Wed, 29 Apr 2015 16:05:36 GMT

That is what I did and then I started getting data on the real-time tab, but no data elsewhere.

Re: How to get support for the Splunk App for Web Analytics?

jbjerke_splunk — Wed, 29 Apr 2015 16:13:05 GMT

Has the data model finished building the index? You can see this by expanding the data model using the little arrow next to it. It should give you a percentage on how long it it has come.

Re: How to get support for the Splunk App for Web Analytics?

dglass0215 — Wed, 29 Apr 2015 17:46:29 GMT

I do not see where this percentage that you speak of is located, However, It does show some data now. However it seems like it is only showing data from today even if I choose something like Year to date. Also under top operating systems it just shows "compatible" whereas I would have expected something like Windows 7.

Re: How to get support for the Splunk App for Web Analytics?

jbjerke_splunk — Fri, 01 May 2015 08:09:40 GMT

Can you double check you selected acceleration for more than 1 day? Set it to 1 month or more to get statistics further back. You can do this disabling and then re-enabling the acceleration.

For the operating system, there might be something off with that field extraction. You should be able to modify that yourself. Perhaps the OS is not contained in the source data?

Re: How to get support for the Splunk App for Web Analytics?

bbiandov — Fri, 17 Jul 2015 14:39:35 GMT

Very helpful discussion. What is the location of WA_settings.csv ? It isn't in /etc/apps/SplunkAppForWebAnalytics/ ?

Re: How to get support for the Splunk App for Web Analytics?

bbiandov — Fri, 17 Jul 2015 14:42:43 GMT

Answered my own question: /opt/splunk/etc/apps/SplunkAppForWebAnalytics/lookups/

Re: How to get support for the Splunk App for Web Analytics?

ECovell — Mon, 18 Apr 2016 15:46:43 GMT

I have been looking at this app and trying to get some gauge of why my information stopped on a specific date on select reports. When I run the real time report I can see data streaming in as prescribed, however, when I go to the traffic center all of the traffic stops on April 3rd. I have gone through and applied all the test that you mentioned earlier in the post and everything is work as it should. Please let me know if you need any specific information in helping me troubleshoot this.

Thank you,
Ernie