Cisco WSA dashboard not displaying some data

[kevindsomers]

I have a new install of Splunk 6.1.1 and have installed the Cisco Security Suite app as well as the Web Security Appliance (WSA) app. The Splunk server is running Windows Server 2008 R2 and is running FTP. One WSA has a log subscription sending the access logs to the WSA.

When I look at the Web Security overview, there is data in Web Security Events, but only errors. The "Proxied Reuests by Category" is empty, and I know from looking at the logs that the category is there. In the "Acceptable Use: Personal Use" the personal use vs other graph shows two values. In order to populate this it must know the category, but again the Top Categories graph says no results found.

Why would this be missing and how do you fix it?

[ocfosecdc]

The line for this lookup goes into which config file? Looking at your main dashboard config file for the WSA add on does not have a line available for this lookup.

[esix_splunk]

For some reason the lookup table isnt applied to extract the fields.

lookup cisco-wsa-category x_webcat_code_abbr OUTPUT x_webcat_code_full  |

If you add that to the saved search for the main dashboard in SA-cisco-wsa, it will populate based of of the x_webcat_code_full categories for Proxied Request. The lookup table should already be defined, however you should check by doing a

| inputlookup cisco-wsa-category

That should get the main dashboard populating and you can get the drilldowns going with that. Let me know if you need more help.

Cheers