Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Missing events for PAVO Network Traffic App
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I install PAVO Network Traffic App for Splunk for splunk enterprise 8.0 (60 day trial), but I does not see any data on dashboard.
I'm just start splunk 2 weeks ago.
I already installed Splunk Common Information Model. I'm already monitor syslog windows 10 and linuxMint VM's (by using respective forwarder)
Please, could you help ?
What is the correct SPL in order to check data?
On which index, PAVO Network Traffic App expected data?
Many thanks in advance for your help.
Samir
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There could be two reasons for this happening. Please check both items to make sure everything is configured properly.
- Make sure the index where your data resides is specified in the "cim_Network_Traffic_indexes" macro.
- This app uses accelerated data so you will want to make sure the Network Traffic data model is accelerated.
You can verify data by running this search
| tstats count from datamodel=Network_Traffic where index=* by sourcetype
or
| datamodel Network_Traffic flat
The first command checks the acceleration and the 2nd command shows the events in the data model.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@saharira were you able to fix the issue? I am having the same problem!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There could be two reasons for this happening. Please check both items to make sure everything is configured properly.
- Make sure the index where your data resides is specified in the "cim_Network_Traffic_indexes" macro.
- This app uses accelerated data so you will want to make sure the Network Traffic data model is accelerated.
You can verify data by running this search
| tstats count from datamodel=Network_Traffic where index=* by sourcetype
or
| datamodel Network_Traffic flat
The first command checks the acceleration and the 2nd command shows the events in the data model.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
