Splunk Security Essentials: Why am I unable to see data in Raw Data Preview?

[bencaudell]

I have been testing the use cases with Splunk Security Essentials. The demo data is all good, but when I switch to Live data, status shows up and I get results returned, but in the Raw Data Preview I see nothing. Also, Detect Spikes and Open is search are grayed out. Is there a reason I can't see the data it is returning?

[David]

Apologies for the delay on this -- apparently I'm not getting notifications about answers anymore..

The simplest answer is usually going to be missing pre-requisite data. I know this question is now 3 months old, but if you copy-paste the SPL to a new search, do you see results there? If not, then you should figure out why you don't get results. Missing data, different field names, etc. If you get really stymied here, happy to help more directly.