Splunk for bluecoat tstats searches

[tmarlette]

I have recently downloaded and installed the splunk for bluecaot app, and i'm having some difficulty adapting it. We are using the legacy proxySG (5.4) so I have usedthe bcreportmain_v1_old transofrm to extract the necessary fields, and this is working properly.

I am having difficulty with some of the other views however, and it seems to be the views that are attempting to utilize the 'tstats' command in the search. take for instance the 'Bandwidth Savings' view. I see absolutely no results, so in troubleshooting I have opened the .xml to see what the search query looks like that this dashboard is using. I put that into a regular search to see if it returned some results, but it returns nothing at all. all searches for this view exhibit the same behavior.

Please take a look. this is for the "Requests" count. The very first result set on the page.

| tstats sum(bytes_in) AS sbi FROM bluecoat_stats | eval mb_in=round(sbi/(1024*1024), 2) | fields mb_in

I've never used the 'tstats' command before, so I'm unfamiliar with it's function, however after viewing the documentation, it looks like this query is attempting to call a named series of data to present statistics on it.

I am in an attempt to figure out what loads the "bluecoat_stats" data block, because it would seem that it may be broken, or needs some tweeking to make it work.

Any suggestions would be greatly appreciated!

[tmarlette · Accepted solution]

Thank you!! I actually found the tscollect command in the 'savedsearches.conf', but I the search was so long I had to actually page over to see the tscollect command.

I have corrected the issue, and this app is working normally. For some reason the macro "bcoat_request" broke in this file, and simply wasn't working for any of the saved searches. I have since adjusted the savedsearches.conf to just use my sourcetype instead of the macro, and all things are now showing results.

[rroberts]

"tscollect" contributes statistics while "tstats" does exactly what you mention. "tscollect" creates a TSIDX file.
TSIDX is similar to summary indexing that allows dramatically improved performance.
It is used in several applications such as Enterprise Security (version 2.4 and later). This feature was first available in Splunk 5.0. Check the scheduled saved searches in the app and see how often they run. At least one of those should have tscollect command in it. You might check out: http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Tscollect