topic Re: No data is getting displayed on dashboard in Getting Data In

No data is getting displayed on dashboard

pratapa — Fri, 10 Jul 2020 11:19:31 GMT

No data is getting displayed on the dashboard.

Following is the query.

index=main sourcetype=wms_oracle_sessions | bucket span=5m _time | stats count AS sessions by _time,warehouse,machine,program | sum(sessions) AS wsessions by _time,warehouse | timechart avg(wsessions) by warehouse

We know the reason for data not getting displayed on dashboard.

Sourcetype wms_oracle_sessions does not exist.

Does it help if we create the sourcetype wms_oracle_sessions

Re: No data is getting displayed on dashboard

isoutamo — Fri, 10 Jul 2020 12:08:17 GMT

Yes it helps with indexed data after you have assign that sourcetype to your data on ingestion phase. Old events still haven’t that sourcetype attribute without reindexing it.

r.ismo

Re: No data is getting displayed on dashboard

gcusello — Fri, 10 Jul 2020 12:21:56 GMT

Hi @pratapa ,

sum sin't a Splunk command, it's a funtion to use in stats or timechart or other commands.

So you should rebuild your search in something like this:

index=main sourcetype=wms_oracle_sessions | bucket span=5m _time | stats count AS sessions by _time,warehouse,machine,program | timechart avg(sum(sessions)) by warehouse

or better (I cannot test it):

index=main sourcetype=wms_oracle_sessions | timechart span=5m avg(dc(program)) by warehouse

Ciao.

Giuseppe

Re: No data is getting displayed on dashboard

pratapa — Wed, 15 Jul 2020 11:25:20 GMT

We have created sourcetype wms_oracle_sessions but no luck.

No data is getting displayed on the dashboard

Re: No data is getting displayed on dashboard

gcusello — Wed, 15 Jul 2020 11:37:17 GMT

Hi @pratapa,

I see that your search is almost the same of answer https://community.splunk.com/t5/Getting-Data-In/Sourcetype-Missing/m-p/509256#M86624

maybe the solution for that answer could help you!

Ciao.

Giuseppe

Re: No data is getting displayed on dashboard

pratapa — Mon, 17 Aug 2020 10:24:07 GMT

How to assi gn the sourcetype wms_oracle_sessions to the data on ingestion phase.

Re: No data is getting displayed on dashboard

rabbidroid — Mon, 17 Aug 2020 16:35:27 GMT

Sourcetypes do not need to exist on the search head. Does the search return results if you remove everything after the raw search? (from the first pipe, till the end)

Re: No data is getting displayed on dashboard

yr — Fri, 21 Jul 2023 22:54:21 GMT

Hi gcusello,

We have Splunk Add -on for AWS installed and configured and we also installed and configured the splunk apps for AWS security dashboard. and we created custom index. But some how we do not see any data on security dashbnboard apps eventhough we see data when we do search outside the apps.

i read up and it says macro search has their own index and we need to change it. but i dont know where to change that index name in search macro.

any help is greatly appreciated.

we have splunk cloud

thank

yogesh

switchfly

Re: No data is getting displayed on dashboard

isoutamo — Fri, 21 Jul 2023 23:04:27 GMT

if I recall right those macro names are told on instructions? If you couldn’t found those there then you could open Settings -> Advanced search. Then there are macros link where you could found those. Correct macro is probably defined on AWS app not in TA side. Open it and just add there your index.

r. Ismo

Re: No data is getting displayed on dashboard

gcusello — Sat, 22 Jul 2023 05:57:44 GMT

Hi @yr ,

the macto con be modified starting from that app in [Settings -> macro].

another solution could be to add you custom indexes to the default search path for the roles of the users that have to use this app: [Settings -> Roles -> <your_role>].

Ciao.

Giuseppe

Re: No data is getting displayed on dashboard

yr — Sat, 22 Jul 2023 18:31:26 GMT

Hello,

unfortunately, i could not see "advanced search" or "macro link" in our splunk cloud.

we have splunk cloud and deploy server to deploy apps and we request splunk support to install both apps (splun apps for aws and splunk apps for aws security dashboard). we created the custom index.

now we search our index on search window and it display the cloudtrail data as well as cloudwatch data. but security dashboard apps dow not pickup the data.

i understand we need to change the index from default index name to our custom index name.

questions:

1. what is installed patch location of apps ?

2. which conf file to update for index?

3. can you please share some screen shots generic please

thank you

Re: No data is getting displayed on dashboard

isoutamo — Sat, 22 Jul 2023 20:18:47 GMT

I’m not sure which role you are needing to see that. I can see it with sc_admin role and I am expecting that it works at least with power role.