All Apps and Add-ons

Web Intelligence application NO data in Distributed environment

paul_1994
Path Finder

I have installed the app on my search heads and created the indexes on my indexers. I have verified on my indexer from the manger that events are being created and I have searched the indexes on the indexer and search head and returned information, but the app is still empty.

Result of search on the summary indexes If this helps

09/25/2012 15:40:00, search_name="Web Traffic by host fivemin summary - regenerator", search_now=1348613100.000, info_min_time=1348612800.000, info_max_time=1348613100.000, info_search_time=1348613119.944, hits=240, myhost=******, sourcename="V:\\Logfiles\\W3SVC1910282147\\ex120925.log", report="\"WA webtraffic host summary index\"" 

Any Help would be appreciated..

0 Karma

paul_1994
Path Finder

So I thought I would follow up on my question. I worked with support and found out a couple of things.

  1. you need to make sure your logs are being transformed correctly via props and transform
  2. A lot of the searches depend on the correct Field aliases being defined

For the Field aliases I had to change the defaults to match my environment with custom sourcetypes.

for example here is a default alias for the WI

(?:::){0}iis-* : FIELDALIAS-clientip

I had to clone the one above and create this one

iis : FIELDALIAS-iis-clientip

because my sourcetype for iis was "iis" not "iis-***"

araitz
Splunk Employee
Splunk Employee

My guess is that your IIS fields are not being extracted properly. When you search your IIS logs using the flashtimeline view, do you see fields like 'cookie', 'referer', 'uri', etc in the field picker? What is the sourcetype that your IIS logs are being assigned?

0 Karma

paul_1994
Path Finder

Hey Araitz- I met you @ .conf this year, but any way..

  1. did you want me to do this search in the web app or the search app. I am not sure if it makes a difference.

  2. In the search app i do an search for sourcetype=iis and it returns all the w3c fields and others in the field picker.

  3. The sourcetype being assigned is iis.. and some instances there is iis-2,3... etc but I am fixing those as I run into them

Thanks

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...