All Apps and Add-ons

splunk for websense

ynait
New Member

hi ,
i have configured websense to send log to my splunk server .
i can see the data in the search app but when i use websense app no data apprs in the dashboard .
how can resolve this issue .
thanks

0 Karma

udayk1
Path Finder

I figured this out on the same day back in 2014. Thanks for all the replies.

0 Karma

NicholasMeyers
New Member

What was the solution?

0 Karma

timothywatson
Path Finder

From what I see in savedsearches.conf, the data must be ingested to the "websense" Index. The "websense_summary" index is also defined, but it is populated by scheduled searches defined within the app. As long as none of the saved-searches break due to missing fields or such, everything should populate and work as expected. 😉

0 Karma

enkhbayarb
New Member

edit your data input, in more settings section, choose "websense summary: in index field.

it is working fine on me.

0 Karma

udayk1
Path Finder

Can anyone throw some lime light on this? I am also facing the same issue, no data appears in this app. Although we receive normal data.

0 Karma

aferone
Builder

Has anyone had any luck with this app? Are the summary indexes supposed to be regularly updated? Or is it all manual? I haven't found any documentation on the app's page or anywhere else for that matter.

0 Karma

mhale1982
Path Finder

You might have two potential issues.

First, are you on Websense 7.7?

Secondly, see this:

http://splunk-base.splunk.com/apps/34715/websense-app-for-splunk

Specifically:

•It would be nice to document the different invocations of fill_summary_index.py that the user has to run in order to backfill the summary indexes that power some of the dashboards. Ideally, you could advertise the need to run these backfill commands on the dashboard itself so that the user understands why no data is displayed.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...