splunk for websense

[ynait]

hi ,
i have configured websense to send log to my splunk server .
i can see the data in the search app but when i use websense app no data apprs in the dashboard .
how can resolve this issue .
thanks

[udayk1]

I figured this out on the same day back in 2014. Thanks for all the replies.

[NicholasMeyers]

What was the solution?

[timothywatson]

From what I see in savedsearches.conf, the data must be ingested to the "websense" Index. The "websense_summary" index is also defined, but it is populated by scheduled searches defined within the app. As long as none of the saved-searches break due to missing fields or such, everything should populate and work as expected. 😉

[enkhbayarb]

edit your data input, in more settings section, choose "websense summary: in index field.

it is working fine on me.

[udayk1]

Can anyone throw some lime light on this? I am also facing the same issue, no data appears in this app. Although we receive normal data.

[aferone]

Has anyone had any luck with this app? Are the summary indexes supposed to be regularly updated? Or is it all manual? I haven't found any documentation on the app's page or anywhere else for that matter.

[mhale1982]

You might have two potential issues.

First, are you on Websense 7.7?

Secondly, see this:

http://splunk-base.splunk.com/apps/34715/websense-app-for-splunk

Specifically:

•It would be nice to document the different invocations of fill_summary_index.py that the user has to run in order to backfill the summary indexes that power some of the dashboards. Ideally, you could advertise the need to run these backfill commands on the dashboard itself so that the user understands why no data is displayed.