All Apps and Add-ons

Applications dashboard for the Dell Sonicwall Analytics app not pulling any data

paduka
Path Finder

The applications dashboard for the Dell Sonicwall Analytics app is not pulling up any data for me. When I search the raw logs we have data for the appcat and appname coming from the sonicwall and the dell_ipfix logs respectively.

However, somehow the dashboard containing Application by Location, Top Applications, App Pie Chart, Applications by time and Top users of Top Applications is not producing any results. Is it because there is some setting while capturing my logs that needs to be switched on that is currently missing or is it because of some misconfiguration in my app setting?

Tags (1)
1 Solution

jalfrey
Communicator

Hi this is the splund developer over here at Dell Sonicwall. I think that some of the scheduled searches are both not included and not being run. I'm working on an update which will be version 1.0.2

The broken part is a search that should generate a lookup table called sonicwall_firewalls.csv which will be located in $SPLUNK_HOME/etc/apps/dsa/lookups

index=sonicwall | dedup host | inputlookup sonicwall_firewalls.csv append=t | eval firewall_hostname=coalesce(firewall_hostname, host) | dedup host | fields host, firewall_hostname | fields - _* | outputlookup sonicwall_firewalls.csv

If you want to further debug this you can go to the applications dashboard and click the magnifying glass on any one of the panels. It will pop out the search and you can see what's going on. The easy way to make the search work is start erasing stuff off the end until it runs.

View solution in original post

jalfrey
Communicator

Hi this is the splund developer over here at Dell Sonicwall. I think that some of the scheduled searches are both not included and not being run. I'm working on an update which will be version 1.0.2

The broken part is a search that should generate a lookup table called sonicwall_firewalls.csv which will be located in $SPLUNK_HOME/etc/apps/dsa/lookups

index=sonicwall | dedup host | inputlookup sonicwall_firewalls.csv append=t | eval firewall_hostname=coalesce(firewall_hostname, host) | dedup host | fields host, firewall_hostname | fields - _* | outputlookup sonicwall_firewalls.csv

If you want to further debug this you can go to the applications dashboard and click the magnifying glass on any one of the panels. It will pop out the search and you can see what's going on. The easy way to make the search work is start erasing stuff off the end until it runs.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...