All Apps and Add-ons

Web intelligence App - backfill summary indexes not showing any data in reports/ dashboards

raghukodali
Engager

I am trying to use Web intelligence app on Splunk 5.x with a standard Apache logs (access_combined) that have all required fields.
In the setup screen, I can see the data indexed with sourcetype="access_c*".
After running backfill scripts, I don't see any data out of the reports/dashboards in the App.

Here are the checks I have done so far
- Make sure that the license is available
- I have edited events.conf to make sure the sourcetype is properly set
- looked in $SPLUNK_HOME/var/spool/splunk directory but did not see any files over there
- I see ERROR UserManager - Error while setting user context: Could not get info for non-existent user="nobody" in splunkd.log
- I checked the user has access to the indexes created by backfill scripts
- the general search is showing the events

Any tips or pointers on how to get the app working ?

-raghu

macycron
Explorer

Try changing the app configuration. In the Web intlligence app, go to setup. In the sourcetypes field, put the name of the index that contains your web logs. Example: instead of sourcetype=access_combined put instead index=yourweblogs.

0 Karma

hexx
Splunk Employee
Splunk Employee

That explains why your summary indexes are not populating. At this point, you're going to need to decompose those searches to understand why they are not returning results. Are they failing to find the expected events? Are they failing to find the expected fields? Unfortunately, there is no easy recipe here. You have to use trial and error.

raghukodali
Engager

Went to Manager -> Searches and saw Reports for Web Intelligence app, there were 124 listed searches. What I could find out is the searches which aren't scheduled and not summarized like "New Visitors Lookup" are showing results.
All the other searches which are scheduled, and have SI and where the searches have index="wi_summary_daily" / "wi_summary_hourly" / "wi_summary_fivemin" are not showing any results.

0 Karma

hexx
Splunk Employee
Splunk Employee

If you manually run in the flashtimeline the searches that are intended to regenerate the summary indexes, do these return any results?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...