Dashboards & Visualizations

Why isn't Vmware carbon black cloud app dashboards populating results?



We are using Vmware carbon black cloud app and the vmware logs are pulled from AWS s3 buckets. The index is having logs. However, the dashboards of the app when configured with same index is not working. Please help remediate.



Labels (1)
0 Karma


Hi @bsanjeeva ,

It's likley an index that is not searchable by default, or a macro needs to be updated to specify the indexes with the data.

Is this the app you are using? (VMware Carbon Black EDR On-Prem)

If so:

  1. Navigate to the Administration > Application Configuration menu, VMware EDR Base Configuration tab.

    1. Update the index names to those created above

    2. Click the Save Application Configuration button to enable the App

Otherwise, open a report panel from the app in search, if it contains macro's, use the CTRL-SHIFT-E shortcut to expand the search. The problem should become a bit more obvious at that point.


I see that you are using the cloud app, not on prem, however similar solution most likley.



  1. Create two Event index(s) for your data.

    • One index for the Carbon Black Cloud data e.g. carbonblackcloud
    • One index for the results of the Alert Actions e.g. vmware_actions


  2. Navigate to the Administration –> Application Configuration menu in the VMware Carbon Black Cloud App

  3. On the VMware CBC Base Configuration tab set the VMware CBC Base Index and VMware CBC Action Index to the index names from step 1 including index= e.g. index=carbonblackcloud



Hi @chaker ,

We have the app installed in splunk cloud and the app used is, https://splunkbase.splunk.com/app/5332/ . I have completed the app setup with index names, but still the dashboard is not working.


0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...