Hi Splunk Community,
x?bu?B?̫,??,??~??<132> 2022-07-25T12:13:03.696064-04:00 L4 FIREWALL: nflog_log_fw(), action=DROP reason=POLICY-INPUT-GEN-DISCARD hook=INPUT mark=136314880 IN=br2 OUT= MAC=00:00:00:00:00:00:8484:26:2b:9b:ea:bd:src=220.127.116.11 DST=xx.yy.zzz.www LEN=44 TOS=0x00 PREC=0x00 TTL=40 ID=2539 PROTO=TCP SPT=19169 DPT=8901 SEQ=3022021036 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 OPT (MSS=1460 )
When a dashboard panel reports "No results found" it means either the data doesn't exist or it exists someplace where the dashboard can't find it. You seem to have ruled out the former so we'll focus on the latter.
The best way to help ensure a dashboard can find its data is by installing the corresponding TA. It's looks like you did that. Did you also restart Splunk after copying the TA directory?
One of the most common reasons a dashboard can't find its data is because it's in a different index. Click on the magnifying glass icon in the lower-right corner of the panel to open it in a search window. There you will see the query the panel is using to find the data. Make sure the index it's looking matches the index where you put the data.
While you're in the search window, check the other parts of the query to make sure the expected sourcetype. etc. match the data coming in.
Hi Rich, thank you for the thoughtful suggestion.
I think the magnifying glass is on the right track. my query was:
`iptables_datasource` (`traffic_denied`) `filter_badclients` | timechart `iptables_span` count as Denied_Connections by iptables_host. That resulted in no results.
currently Datasource is set to "index=* eventtype="linux_netfilter""
When I changed "( clientip!="0.0.0.0" OR clientip!="255.255.255.255")" to "()" it opened the floodgate on my dashboard. Now I'm getting a lot of events in "volumes of connections", "network services" and "destination ports", but still translation of IP to Client location or stats on Trend by Country.
I then changed the index=* to each of the 13 splunk indexes and only "main" returns anything. So it feels like maybe I still need to either create a new bespoke index or configure CIM correctly and 'fix' that cim_modactions index. I'm still a little confused but grateful for your help and happy I'm moving forward 🙂
in any case thank you for getting me in the right direction.