no data in veeam App

[topgun]

Hi,

we recently installed the Veeam App for Splunk and put the logs from our Veeam Backup & Replication and Veeam One server into it. Unfortunatelly we are getting no data in the Veeam Data Platform Monitoring or Veeam Security Events section.

We can see the raw logs and also the fileds.

Does anyone has an idea why we are getting no data in the veeam app?

Best regards

[aind]

The Veeam Backup & Replication Events (VeeamVbrEvents) Data Model requires the "original_host" field to be in events.
Looking at your screenshots, it looks like that field is missing from your events - I've come across this issue too.
The Veeam app includes a "veeam_vbr_syslog : EXTRACT-original_host" field extraction that wasn't working for me - it used this regex:

\d+-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+[\+\-]\d{2}:\d{2}\s(?<original_host>\S+)

This is expecting the "original_host" to be listed in the raw event after the timestamp and a space.
Are you sending syslog direct to Splunk as per the Veeam App documentation, or are you sending it via SC4S or another syslog server?
In the scenario I came across this issue, Veeam was sending syslog to SC4S which was stripping the timestamp out of the raw event, therefore breaking the original_host extraction.
SC4S was actually setting the "host" value for each event correctly, so I was able to add a Field Alias instead - set to apply to the veeam_vbr_syslog sourcetype and set host = original_host like this:

 

[DeHaan]

Hi Aind, 

This worked for me as well! Thanks for helping us out!

[topgun]

Hi aind,

your suggestions sounded good and I created a field alias for host to original_host with the source veeam as follows

Unfortunatelly this didn't help. Do you have any other ideas or did I something wrong?

[aind]

Can you see the "original_host" field in the events in your Veeam index now?

[topgun]

unfortunatelly not, I see only the host field. I tried it in the Search & Reporting and also in the Veeam Search field but  only the host field. Is the field alias configured wrong?

[aind · Accepted solution]

I think so! Looking again at the screen like your Field alias is applied to a sourcetype of "veeam" not "veeam_vbr_syslog" - suggest you check that
The Data model expects sourcetype="veeam_vbr_syslog" - is that the sourcetype applied to the Veeam data coming in?

[topgun]

It works now. Thank you very much

[topgun]

Looks better now. I changed the sourcetype from "veeam" to "veeam_vbr_syslog" like you said. Now I see a "transferred data" rate. There should be more data tomorrow. I will get back to you.

[richgalloway]

Apps are empty either because the data they need isn't present or because the data can't be found.  You've shown the former is not true so it must be the latter.

Confirm the data is in the index(es) where Veeam expects to find it.  If Veeam uses a datamodel (I suspect it does) then your data must be tagged so it is found by the DM.  Look at the DM definition to see which indexes and tags it needs.

[topgun]

Hi richgalloway,

from my point of view the index and the datamodel fields are looking good.

[richgalloway]

The datamodel is looking for specific values in the instanceId field, however, the screenshot does not show an instanceId field exists in the data.  Therefore, the DM will return no results and the dashboard will show nothing.

[topgun]

you are right but there are logs which have the instanceid field.

[richgalloway]

That event does indeed contain in instanceId field, but the sourcetype may not match the "veeam_vbr_syslog" value expected by the DM.  It's hard to tell from the obscured screenshot.

Everything in the "constraints" section of the DM must match your data for it to be found by the DM and appear in the dashboard.