(Beta) Proofpoint Email Security App for Splunk content returns no results

[mdsnmss]

This isn't a question but a post to help point out a reason you may not be seeing content in your reports or dashboards using the (Beta) Proofpoint Email Security App for Splunk. It has to do with a macro used at the beginning of each search in order to set the index. You must change the macro to point to the index where your Proofpoint data (pps__log) is.

[eckolp2003]

Have you been able to verify you have data coming in? Can you confirm all the steps you have done so far?

The app setup is fairly well documented here:

https://splunkbase.splunk.com/app/3080/#/details

We need to determine if this is a sourcetype issue or some other problem.

[mdsnmss · Accepted solution]

To change the macro open up Settings-->Advanced Search-->Search macros. Go to the app context "Proofpoint Email Security App for Splunk". There is a macro labeled get_pps_index. The macro is set to explicitly point to index=main. Since it is unlikely you are sending all of your Proofpoint data to "main" you should open this macro and change it to the index where your PPS data is sent.

[eckolp2003]

Thanks for documenting this for others!

[vnguyen46]

Thank you so much. It's a big help. I have been searching for days to resolve this issue.

[jrsanders]

Nevermind. I figured it out. I needed to add the Add-on to my indexer as well.

[eckolp2003]

Could you tell me more about your deployment? Most deployments should not need this installed on an indexer.

[jrsanders]

Our deployment consist of One Search Head and One Indexer. Our Proofpoint servers send their logs directly to the indexer.

[eckolp2003]

Ok, that explains why. The TA's should normally go on a heavy forwarder and if you are not using one, they would have to go on your indexer.

[jrsanders]

Thank you for the input. Sorry about my earlier comment. I was venting a little.

[jrsanders]

I've done that and I'm still not getting data. Plus there is little to no documentation for this app.