topic no data in veeam App in All Apps and Add-ons

no data in veeam App

topgun — Tue, 16 Jul 2024 07:15:38 GMT

Hi,

we recently installed the Veeam App for Splunk and put the logs from our Veeam Backup & Replication and Veeam One server into it. Unfortunatelly we are getting no data in the Veeam Data Platform Monitoring or Veeam Security Events section.

We can see the raw logs and also the fileds.

Does anyone has an idea why we are getting no data in the veeam app?

Best regards

Re: no data in veeam App

richgalloway — Tue, 16 Jul 2024 14:48:58 GMT

Apps are empty either because the data they need isn't present or because the data can't be found. You've shown the former is not true so it must be the latter.

Confirm the data is in the index(es) where Veeam expects to find it. If Veeam uses a datamodel (I suspect it does) then your data must be tagged so it is found by the DM. Look at the DM definition to see which indexes and tags it needs.

Re: no data in veeam App

topgun — Fri, 19 Jul 2024 06:12:48 GMT

Hi richgalloway,

from my point of view the index and the datamodel fields are looking good.

Re: no data in veeam App

richgalloway — Fri, 19 Jul 2024 14:25:24 GMT

The datamodel is looking for specific values in the instanceId field, however, the screenshot does not show an instanceId field exists in the data. Therefore, the DM will return no results and the dashboard will show nothing.

Re: no data in veeam App

topgun — Mon, 22 Jul 2024 06:48:28 GMT

you are right but there are logs which have the instanceid field.

Re: no data in veeam App

richgalloway — Mon, 22 Jul 2024 12:11:03 GMT

That event does indeed contain in instanceId field, but the sourcetype may not match the "veeam_vbr_syslog" value expected by the DM. It's hard to tell from the obscured screenshot.

Everything in the "constraints" section of the DM must match your data for it to be found by the DM and appear in the dashboard.

Re: no data in veeam App

aind — Mon, 29 Jul 2024 12:07:04 GMT

The Veeam Backup & Replication Events (VeeamVbrEvents) Data Model requires the "original_host" field to be in events.
Looking at your screenshots, it looks like that field is missing from your events - I've come across this issue too.
The Veeam app includes a "veeam_vbr_syslog : EXTRACT-original_host" field extraction that wasn't working for me - it used this regex:

\d+-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+[\+\-]\d{2}:\d{2}\s(?<original_host>\S+)

This is expecting the "original_host" to be listed in the raw event after the timestamp and a space.
Are you sending syslog direct to Splunk as per the Veeam App documentation, or are you sending it via SC4S or another syslog server?
In the scenario I came across this issue, Veeam was sending syslog to SC4S which was stripping the timestamp out of the raw event, therefore breaking the original_host extraction.
SC4S was actually setting the "host" value for each event correctly, so I was able to add a Field Alias instead - set to apply to the veeam_vbr_syslog sourcetype and set host = original_host like this:

Re: no data in veeam App

topgun — Thu, 01 Aug 2024 06:42:45 GMT

Hi aind,

your suggestions sounded good and I created a field alias for host to original_host with the source veeam as follows

Unfortunatelly this didn't help. Do you have any other ideas or did I something wrong?

Re: no data in veeam App

aind — Mon, 05 Aug 2024 11:10:33 GMT

Can you see the "original_host" field in the events in your Veeam index now?

Re: no data in veeam App

topgun — Tue, 06 Aug 2024 07:03:50 GMT

unfortunatelly not, I see only the host field. I tried it in the Search & Reporting and also in the Veeam Search field but only the host field. Is the field alias configured wrong?

Re: no data in veeam App

aind — Tue, 06 Aug 2024 11:28:14 GMT

I think so! Looking again at the screen like your Field alias is applied to a sourcetype of "veeam" not "veeam_vbr_syslog" - suggest you check that
The Data model expects sourcetype="veeam_vbr_syslog" - is that the sourcetype applied to the Veeam data coming in?

Re: no data in veeam App

topgun — Tue, 06 Aug 2024 11:35:54 GMT

Looks better now. I changed the sourcetype from "veeam" to "veeam_vbr_syslog" like you said. Now I see a "transferred data" rate. There should be more data tomorrow. I will get back to you.

Re: no data in veeam App

topgun — Wed, 07 Aug 2024 07:34:40 GMT

It works now. Thank you very much

Re: no data in veeam App

DeHaan — Fri, 06 Sep 2024 09:22:08 GMT

Hi Aind,

This worked for me as well! Thanks for helping us out!