https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Toubleshooting-the-Web-Data-Model/m-p/317866#M2915 <P>Hi All</P> <P>I am looking for for some troubleshooting pointers for the following issue:</P> <OL> <LI>I have Splunk Enterprise Security installed and I am currently configuring it.</LI> <LI>Receiving logs from cisco:wsa:squid</LI> <LI>Splunk ES does not recognize the tags for the Web Data Model</LI> <LI>The following searches run successfully outside of the Splunk ES App <STRONG>| datamodel Web Web search</STRONG> or <STRONG>(<CODE>cim_Web_indexes</CODE>) (tag=web tag=proxy)</STRONG></LI> <LI>The same searches fail inside the Splunk ES app</LI> <LI>All TAs have been added with global permissions</LI> <LI>The Data model has had it's constraints set <STRONG>(<CODE>cim_Web_indexes</CODE>) (tag=web)</STRONG></LI> </OL> <P>Thanks</P> Wed, 17 Jan 2018 14:19:51 GMT davidmonaghan 2018-01-17T14:19:51Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Toubleshooting-the-Web-Data-Model/m-p/317866#M2915 <P>Hi All</P> <P>I am looking for for some troubleshooting pointers for the following issue:</P> <OL> <LI>I have Splunk Enterprise Security installed and I am currently configuring it.</LI> <LI>Receiving logs from cisco:wsa:squid</LI> <LI>Splunk ES does not recognize the tags for the Web Data Model</LI> <LI>The following searches run successfully outside of the Splunk ES App <STRONG>| datamodel Web Web search</STRONG> or <STRONG>(<CODE>cim_Web_indexes</CODE>) (tag=web tag=proxy)</STRONG></LI> <LI>The same searches fail inside the Splunk ES app</LI> <LI>All TAs have been added with global permissions</LI> <LI>The Data model has had it's constraints set <STRONG>(<CODE>cim_Web_indexes</CODE>) (tag=web)</STRONG></LI> </OL> <P>Thanks</P> Wed, 17 Jan 2018 14:19:51 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Toubleshooting-the-Web-Data-Model/m-p/317866#M2915 davidmonaghan 2018-01-17T14:19:51Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Toubleshooting-the-Web-Data-Model/m-p/317867#M2916 <P>I believe I have discovered a solution to this problem.</P> <P>Under <STRONG>Settings -&gt; Event Types -&gt; Splunk Add-on for Cisco WSA</STRONG> </P> <P>The tag was not set for the <STRONG>cisco:wsa:squid</STRONG> event-type</P> <P>Once this was changed and the Web Data Model was rebuilt, events began to populate in Cisco ES</P> Wed, 17 Jan 2018 15:32:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Toubleshooting-the-Web-Data-Model/m-p/317867#M2916 davidmonaghan 2018-01-17T15:32:22Z