topic Re: (Beta) Proofpoint Email Security App for Splunk content returns no results in All Apps and Add-ons

(Beta) Proofpoint Email Security App for Splunk content returns no results

mdsnmss — Wed, 11 Oct 2017 14:19:24 GMT

This isn't a question but a post to help point out a reason you may not be seeing content in your reports or dashboards using the (Beta) Proofpoint Email Security App for Splunk. It has to do with a macro used at the beginning of each search in order to set the index. You must change the macro to point to the index where your Proofpoint data (pps__log) is.

Re: (Beta) Proofpoint Email Security App for Splunk content returns no results

mdsnmss — Tue, 29 Sep 2020 16:08:44 GMT

To change the macro open up Settings-->Advanced Search-->Search macros. Go to the app context "Proofpoint Email Security App for Splunk". There is a macro labeled get_pps_index. The macro is set to explicitly point to index=main. Since it is unlikely you are sending all of your Proofpoint data to "main" you should open this macro and change it to the index where your PPS data is sent.

Re: (Beta) Proofpoint Email Security App for Splunk content returns no results

eckolp2003 — Mon, 16 Oct 2017 16:47:50 GMT

Thanks for documenting this for others!

Re: (Beta) Proofpoint Email Security App for Splunk content returns no results

jrsanders — Thu, 01 Feb 2018 20:41:40 GMT

I've done that and I'm still not getting data. Plus there is little to no documentation for this app.

Re: (Beta) Proofpoint Email Security App for Splunk content returns no results

eckolp2003 — Thu, 01 Feb 2018 20:49:01 GMT

Have you been able to verify you have data coming in? Can you confirm all the steps you have done so far?

The app setup is fairly well documented here:

https://splunkbase.splunk.com/app/3080/#/details

We need to determine if this is a sourcetype issue or some other problem.

Re: (Beta) Proofpoint Email Security App for Splunk content returns no results

jrsanders — Thu, 01 Feb 2018 21:00:13 GMT

Nevermind. I figured it out. I needed to add the Add-on to my indexer as well.

Re: (Beta) Proofpoint Email Security App for Splunk content returns no results

eckolp2003 — Thu, 01 Feb 2018 21:02:20 GMT

Could you tell me more about your deployment? Most deployments should not need this installed on an indexer.

Re: (Beta) Proofpoint Email Security App for Splunk content returns no results

jrsanders — Thu, 01 Feb 2018 21:33:20 GMT

Our deployment consist of One Search Head and One Indexer. Our Proofpoint servers send their logs directly to the indexer.

Re: (Beta) Proofpoint Email Security App for Splunk content returns no results

eckolp2003 — Thu, 01 Feb 2018 21:41:13 GMT

Ok, that explains why. The TA's should normally go on a heavy forwarder and if you are not using one, they would have to go on your indexer.

Re: (Beta) Proofpoint Email Security App for Splunk content returns no results

jrsanders — Thu, 01 Feb 2018 21:43:44 GMT

Thank you for the input. Sorry about my earlier comment. I was venting a little.

Re: (Beta) Proofpoint Email Security App for Splunk content returns no results

vnguyen46 — Wed, 06 Feb 2019 15:23:22 GMT

Thank you so much. It's a big help. I have been searching for days to resolve this issue.