Missing events for PAVO Network Traffic App

[saharira]

Hi,
I install PAVO Network Traffic App for Splunk for splunk enterprise 8.0 (60 day trial), but I does not see any data on dashboard.
I'm just start splunk 2 weeks ago.
I already installed Splunk Common Information Model. I'm already monitor syslog windows 10 and linuxMint VM's (by using respective forwarder)
Please, could you help ?

What is the correct SPL in order to check data?
On which index, PAVO Network Traffic App expected data?

Many thanks in advance for your help.
Samir

[HakobA]

@saharira were you able to fix the issue? I am having the same problem! 

[aplura_llc_supp · Accepted solution]

There could be two reasons for this happening. Please check both items to make sure everything is configured properly.

1. Make sure the index where your data resides is specified in the "cim_Network_Traffic_indexes" macro.
2. This app uses accelerated data so you will want to make sure the Network Traffic data model is accelerated.

You can verify data by running this search

| tstats count from datamodel=Network_Traffic where index=* by sourcetype

or

| datamodel Network_Traffic flat

The first command checks the acceleration and the 2nd command shows the events in the data model.