I have a new install of Splunk 6.1.1 and have installed the Cisco Security Suite app as well as the Web Security Appliance (WSA) app. The Splunk server is running Windows Server 2008 R2 and is running FTP. One WSA has a log subscription sending the access logs to the WSA.
When I look at the Web Security overview, there is data in Web Security Events, but only errors. The "Proxied Reuests by Category" is empty, and I know from looking at the logs that the category is there. In the "Acceptable Use: Personal Use" the personal use vs other graph shows two values. In order to populate this it must know the category, but again the Top Categories graph says no results found.
If you add that to the saved search for the main dashboard in SA-cisco-wsa, it will populate based of of the xwebcatcode_full categories for Proxied Request. The lookup table should already be defined, however you should check by doing a
| inputlookup cisco-wsa-category
That should get the main dashboard populating and you can get the drilldowns going with that. Let me know if you need more help.