Zscaler - Splunk : Logs aren't shown

sarashafek — Fri, 24 Nov 2023 10:11:58 GMT

Hi,

I have a Nanalog Streaming Service (NSS) from Zscaler that I have connected to Splunk.
The problem is it doesn't show any data on the dashboard. But if I look into 'search' , there is data.

This is the feed output format I have configured on the Zscaler Admin Portal for my splunk feed :

"%s{time}","%s{login}","%s{proto}","%s{eurl}","%s{action}","%s{appname}","%s{appclass}","%d{reqsize}","%d{respsize}","%s{urlclass}","%s{urlsupercat}","%s{urlcat}","%s{malwarecat}","%s{threatname}","%d{riskscore}","%s{dlpeng}","%s{dlpdict}","%s{location}","%s{dept}","%s{cip}","%s{sip}","%s{reqmethod}","%s{respcode}","%s{ua}","%s{ereferer}","%s{ruletype}","%s{rulelabel}","%s{contenttype}","%s{unscannabletype}","%s{deviceowner}","%s{devicehostname}","%s{keyprotectiontype}"

Any suggestions on how I can further troubleshoot?

Re: Zscaler - Splunk : Logs aren't shown

PickleRick — Fri, 24 Nov 2023 11:48:15 GMT

I don't know this app but first thing I'd do with any such issue would be to do "open in search" on those panels and see what is the underlying search and try to see why it's not working properly. Maybe it expects other data than you have. Maybe it searches from a wrong place....

topic Re: Zscaler - Splunk : Logs aren't shown in Dashboards & Visualizations

Zscaler - Splunk : Logs aren't shown

Re: Zscaler - Splunk : Logs aren't shown