All Apps and Add-ons

Cisco WSA dashboard not displaying some data

kevindsomers
New Member

I have a new install of Splunk 6.1.1 and have installed the Cisco Security Suite app as well as the Web Security Appliance (WSA) app. The Splunk server is running Windows Server 2008 R2 and is running FTP. One WSA has a log subscription sending the access logs to the WSA.

When I look at the Web Security overview, there is data in Web Security Events, but only errors. The "Proxied Reuests by Category" is empty, and I know from looking at the logs that the category is there. In the "Acceptable Use: Personal Use" the personal use vs other graph shows two values. In order to populate this it must know the category, but again the Top Categories graph says no results found.

Why would this be missing and how do you fix it?

0 Karma

ocfosecdc
New Member

The line for this lookup goes into which config file? Looking at your main dashboard config file for the WSA add on does not have a line available for this lookup.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

For some reason the lookup table isnt applied to extract the fields.

lookup cisco-wsa-category x_webcat_code_abbr OUTPUT x_webcat_code_full  |

If you add that to the saved search for the main dashboard in SA-cisco-wsa, it will populate based of of the x_webcat_code_full categories for Proxied Request. The lookup table should already be defined, however you should check by doing a

| inputlookup cisco-wsa-category

That should get the main dashboard populating and you can get the drilldowns going with that. Let me know if you need more help.

Cheers

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...