Splunk App for Web Analytics and Splunk Weblog Add-on: Why is no data returned from the lookups?

[hoopydave]

We installed these apps on our search head. We followed the instructions installing Splunk Weblog Add-on and it is enable, Sourcetype for our data is iis. The host and source don't show in the Available host and source combinations. I can manually search from the Splunk search app and see the data is there, but the Lookups come back with 0 records found.

[fausap]

Hello,
I had some problems too.

I configured the app, with 3 months of data, and I also accelerated the dataset without any problem, but when I go to Analytics dashboard, I can see only the data for the current day.
The "generate user sessions" and "generate pages" lookups ran successfully displaying the entire period of 3 months.

Any idea about this odd behaviour ?

thanks,
Fausto

[hoopydave · Accepted solution]

As is tums out, the role we are in did not have the correct searching capabilities in Splunk. We needed to add All non-internal indexes to the Selected indexes in Access controls » Roles » [ROLE NAME]. We only had MAIN selected. Once we added that, we were able to see data.

[sinash]

Self-experience: Even if you're using the admin account, you have to add All non-internal indexes and All internal indexes to Indexes searched by default.

[jbjerke_splunk]

Hi hoopydave

The search powering the panel in the Website configuration looks like this:

| tstats prestats=t count where index=* by host,source | stats count AS events by host, source | search host=*"*"* OR source=*"*"*

Make sure that the search returns something. If not, can you try and running the search:

tag=web

and see if that returns something.

Please note that Splunk app for Web Analytics will only work on Splunk version 6.2 and higher.

j