Applications dashboard for the Dell Sonicwall Analytics app not pulling any data

[paduka]

The applications dashboard for the Dell Sonicwall Analytics app is not pulling up any data for me. When I search the raw logs we have data for the appcat and appname coming from the sonicwall and the dell_ipfix logs respectively.

However, somehow the dashboard containing Application by Location, Top Applications, App Pie Chart, Applications by time and Top users of Top Applications is not producing any results. Is it because there is some setting while capturing my logs that needs to be switched on that is currently missing or is it because of some misconfiguration in my app setting?

[jalfrey · Accepted solution]

Hi this is the splund developer over here at Dell Sonicwall. I think that some of the scheduled searches are both not included and not being run. I'm working on an update which will be version 1.0.2

The broken part is a search that should generate a lookup table called sonicwall_firewalls.csv which will be located in $SPLUNK_HOME/etc/apps/dsa/lookups

index=sonicwall | dedup host | inputlookup sonicwall_firewalls.csv append=t | eval firewall_hostname=coalesce(firewall_hostname, host) | dedup host | fields host, firewall_hostname | fields - _* | outputlookup sonicwall_firewalls.csv

If you want to further debug this you can go to the applications dashboard and click the magnifying glass on any one of the panels. It will pop out the search and you can see what's going on. The easy way to make the search work is start erasing stuff off the end until it runs.