- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: Web Intelligence App - no data
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I just set this up yesterday and am very new at this. I am using a linux sserver and I am trying to analyze IIS logs for Jan 1 and 2, 2012. I followed the setup instructions and ran the backfill_all script, which took forever. When I run the real-time dashboard for the first five minutes of Jan 1, I see data, but if I run it any longer, there is no data. When I go to Manager -> Indexes, it is showing the summary indexes are empty and I am suspecting this is the problem. How do I get these summary indexes filled, or do I have a different problem?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I decided to uninstall splunk and start over. After reinstalling it and re-importing my logs and running the backfill script, everything is working now.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I decided to uninstall splunk and start over. After reinstalling it and re-importing my logs and running the backfill script, everything is working now.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've looked through the threads ChrisG posted as well and am still not finding answers that work.
I installed WI, Copied a series of windows IIS logs from my web server (this is the test environment), created an index and performed add data (all of which lives in the WI context) for the log file directory. All of these files have indexed into the index I created. I ran backfill_all.bat (after changing it to go back 2 years from today which matches up with my data) and have waited for it to run... none of the wi_summary* indexes are receiving any data... and as such our dashboard is not working.
Please help with next steps?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are some other Answers threads that might help, too:
http://splunk-base.splunk.com/answers/32287/web-intelligence-no-results-found
http://splunk-base.splunk.com/answers/34974/no-results-found-using-web-intelligence-app
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The backfill_all.sh script should of taken care of this.
What settings did you use when you ran the setup? A screen shot would be great..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I wanted to see what options you had used while setting up the app. Re-reading your issue I see that you actually have data showing up, just nothing past the first 5 minutes.
Were there any issues around the backfill_all script running?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Before I ran the backfill_all.sh script, I changed the earliestTime and latestTime to match the Jan 1-3 timestamps. Then I just ran the script.
What would you like a screen shot of?
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
