All Apps and Add-ons

Web Intelligence application NO data in Distributed environment

paul_1994
Path Finder

I have installed the app on my search heads and created the indexes on my indexers. I have verified on my indexer from the manger that events are being created and I have searched the indexes on the indexer and search head and returned information, but the app is still empty.

Result of search on the summary indexes If this helps

09/25/2012 15:40:00, search_name="Web Traffic by host fivemin summary - regenerator", search_now=1348613100.000, info_min_time=1348612800.000, info_max_time=1348613100.000, info_search_time=1348613119.944, hits=240, myhost=******, sourcename="V:\\Logfiles\\W3SVC1910282147\\ex120925.log", report="\"WA webtraffic host summary index\"" 

Any Help would be appreciated..

0 Karma

paul_1994
Path Finder

So I thought I would follow up on my question. I worked with support and found out a couple of things.

  1. you need to make sure your logs are being transformed correctly via props and transform
  2. A lot of the searches depend on the correct Field aliases being defined

For the Field aliases I had to change the defaults to match my environment with custom sourcetypes.

for example here is a default alias for the WI

(?:::){0}iis-* : FIELDALIAS-clientip

I had to clone the one above and create this one

iis : FIELDALIAS-iis-clientip

because my sourcetype for iis was "iis" not "iis-***"

araitz
Splunk Employee
Splunk Employee

My guess is that your IIS fields are not being extracted properly. When you search your IIS logs using the flashtimeline view, do you see fields like 'cookie', 'referer', 'uri', etc in the field picker? What is the sourcetype that your IIS logs are being assigned?

0 Karma

paul_1994
Path Finder

Hey Araitz- I met you @ .conf this year, but any way..

  1. did you want me to do this search in the web app or the search app. I am not sure if it makes a difference.

  2. In the search app i do an search for sourcetype=iis and it returns all the w3c fields and others in the field picker.

  3. The sourcetype being assigned is iis.. and some instances there is iis-2,3... etc but I am fixing those as I run into them

Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...