All Apps and Add-ons

Web intelligence App - backfill summary indexes not showing any data in reports/ dashboards

raghukodali
Engager

I am trying to use Web intelligence app on Splunk 5.x with a standard Apache logs (access_combined) that have all required fields.
In the setup screen, I can see the data indexed with sourcetype="access_c*".
After running backfill scripts, I don't see any data out of the reports/dashboards in the App.

Here are the checks I have done so far
- Make sure that the license is available
- I have edited events.conf to make sure the sourcetype is properly set
- looked in $SPLUNK_HOME/var/spool/splunk directory but did not see any files over there
- I see ERROR UserManager - Error while setting user context: Could not get info for non-existent user="nobody" in splunkd.log
- I checked the user has access to the indexes created by backfill scripts
- the general search is showing the events

Any tips or pointers on how to get the app working ?

-raghu

macycron
Explorer

Try changing the app configuration. In the Web intlligence app, go to setup. In the sourcetypes field, put the name of the index that contains your web logs. Example: instead of sourcetype=access_combined put instead index=yourweblogs.

0 Karma

hexx
Splunk Employee
Splunk Employee

That explains why your summary indexes are not populating. At this point, you're going to need to decompose those searches to understand why they are not returning results. Are they failing to find the expected events? Are they failing to find the expected fields? Unfortunately, there is no easy recipe here. You have to use trial and error.

raghukodali
Engager

Went to Manager -> Searches and saw Reports for Web Intelligence app, there were 124 listed searches. What I could find out is the searches which aren't scheduled and not summarized like "New Visitors Lookup" are showing results.
All the other searches which are scheduled, and have SI and where the searches have index="wi_summary_daily" / "wi_summary_hourly" / "wi_summary_fivemin" are not showing any results.

0 Karma

hexx
Splunk Employee
Splunk Employee

If you manually run in the flashtimeline the searches that are intended to regenerate the summary indexes, do these return any results?

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...