https://community.splunk.com/t5/All-Apps-and-Add-ons/ModSecurity-App-not-reporting/m-p/73876#M4672 <P>I have the modsecurity app installed and all the third party apps installed in /opt/splunk/etc/apps. Data is being sent to splunk with the correct source and sourcetype, but the app doesn't create any charts. Any specific steps to complete the install?</P> Fri, 17 Feb 2012 17:10:08 GMT pfleetwood 2012-02-17T17:10:08Z https://community.splunk.com/t5/All-Apps-and-Add-ons/ModSecurity-App-not-reporting/m-p/73876#M4672 <P>I have the modsecurity app installed and all the third party apps installed in /opt/splunk/etc/apps. Data is being sent to splunk with the correct source and sourcetype, but the app doesn't create any charts. Any specific steps to complete the install?</P> Fri, 17 Feb 2012 17:10:08 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/ModSecurity-App-not-reporting/m-p/73876#M4672 pfleetwood 2012-02-17T17:10:08Z https://community.splunk.com/t5/All-Apps-and-Add-ons/ModSecurity-App-not-reporting/m-p/73877#M4673 <P>I got it working. In the Manager --&gt; Fields --&gt; Field Aliases, there were two settings. I removed the entry with xforwardedfor completely and changed the remaining "srcip AS clientip2" to "srcip AS clientip". Works beautifully.</P> Fri, 24 Feb 2012 18:10:24 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/ModSecurity-App-not-reporting/m-p/73877#M4673 pfleetwood 2012-02-24T18:10:24Z https://community.splunk.com/t5/All-Apps-and-Add-ons/ModSecurity-App-not-reporting/m-p/73878#M4674 <P>Hello,</P> <P>I also have the same problem. I can see the alert in the Overview Dashboard only in the window Modsec alert trend but don't get any data for modsec denied by ip or host. Splunk collects the data on a reverse proxy. Can this be the issue? (I also tried the above solution but without success...). Thanks </P> Thu, 28 Mar 2013 13:44:57 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/ModSecurity-App-not-reporting/m-p/73878#M4674 vm 2013-03-28T13:44:57Z