All Apps and Add-ons

Splunk App for Web Analytics and Splunk Weblog Add-on: Why is no data returned from the lookups?

hoopydave
Path Finder

We installed these apps on our search head. We followed the instructions installing Splunk Weblog Add-on and it is enable, Sourcetype for our data is iis. The host and source don't show in the Available host and source combinations. I can manually search from the Splunk search app and see the data is there, but the Lookups come back with 0 records found.

0 Karma
1 Solution

hoopydave
Path Finder

As is tums out, the role we are in did not have the correct searching capabilities in Splunk. We needed to add All non-internal indexes to the Selected indexes in Access controls » Roles » [ROLE NAME]. We only had MAIN selected. Once we added that, we were able to see data.

View solution in original post

fausap
Explorer

Hello,
I had some problems too.

I configured the app, with 3 months of data, and I also accelerated the dataset without any problem, but when I go to Analytics dashboard, I can see only the data for the current day.
The "generate user sessions" and "generate pages" lookups ran successfully displaying the entire period of 3 months.

Any idea about this odd behaviour ?

thanks,
Fausto

0 Karma

hoopydave
Path Finder

As is tums out, the role we are in did not have the correct searching capabilities in Splunk. We needed to add All non-internal indexes to the Selected indexes in Access controls » Roles » [ROLE NAME]. We only had MAIN selected. Once we added that, we were able to see data.

sinash
Explorer

Self-experience: Even if you're using the admin account, you have to add All non-internal indexes and All internal indexes to Indexes searched by default.

0 Karma

jbjerke_splunk
Splunk Employee
Splunk Employee

Hi hoopydave

The search powering the panel in the Website configuration looks like this:

| tstats prestats=t count where index=* by host,source | stats count AS events by host, source | search host=*"*"* OR source=*"*"*

Make sure that the search returns something. If not, can you try and running the search:

tag=web

and see if that returns something.

Please note that Splunk app for Web Analytics will only work on Splunk version 6.2 and higher.

j

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...