All Apps and Add-ons

Applications dashboard for the Dell Sonicwall Analytics app not pulling any data

paduka
Path Finder

The applications dashboard for the Dell Sonicwall Analytics app is not pulling up any data for me. When I search the raw logs we have data for the appcat and appname coming from the sonicwall and the dell_ipfix logs respectively.

However, somehow the dashboard containing Application by Location, Top Applications, App Pie Chart, Applications by time and Top users of Top Applications is not producing any results. Is it because there is some setting while capturing my logs that needs to be switched on that is currently missing or is it because of some misconfiguration in my app setting?

Tags (1)
1 Solution

jalfrey
Communicator

Hi this is the splund developer over here at Dell Sonicwall. I think that some of the scheduled searches are both not included and not being run. I'm working on an update which will be version 1.0.2

The broken part is a search that should generate a lookup table called sonicwall_firewalls.csv which will be located in $SPLUNK_HOME/etc/apps/dsa/lookups

index=sonicwall | dedup host | inputlookup sonicwall_firewalls.csv append=t | eval firewall_hostname=coalesce(firewall_hostname, host) | dedup host | fields host, firewall_hostname | fields - _* | outputlookup sonicwall_firewalls.csv

If you want to further debug this you can go to the applications dashboard and click the magnifying glass on any one of the panels. It will pop out the search and you can see what's going on. The easy way to make the search work is start erasing stuff off the end until it runs.

View solution in original post

jalfrey
Communicator

Hi this is the splund developer over here at Dell Sonicwall. I think that some of the scheduled searches are both not included and not being run. I'm working on an update which will be version 1.0.2

The broken part is a search that should generate a lookup table called sonicwall_firewalls.csv which will be located in $SPLUNK_HOME/etc/apps/dsa/lookups

index=sonicwall | dedup host | inputlookup sonicwall_firewalls.csv append=t | eval firewall_hostname=coalesce(firewall_hostname, host) | dedup host | fields host, firewall_hostname | fields - _* | outputlookup sonicwall_firewalls.csv

If you want to further debug this you can go to the applications dashboard and click the magnifying glass on any one of the panels. It will pop out the search and you can see what's going on. The easy way to make the search work is start erasing stuff off the end until it runs.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...