Zscaler - Splunk : Logs aren't shown

[sarashafek]

Hi,

I have a Nanalog Streaming Service (NSS) from Zscaler that I have connected to Splunk. 
The problem is it doesn't show any data on the dashboard. But if I look into 'search' , there is data.

This is the feed output format I have configured on the Zscaler Admin Portal for my splunk feed :

"%s{time}","%s{login}","%s{proto}","%s{eurl}","%s{action}","%s{appname}","%s{appclass}","%d{reqsize}","%d{respsize}","%s{urlclass}","%s{urlsupercat}","%s{urlcat}","%s{malwarecat}","%s{threatname}","%d{riskscore}","%s{dlpeng}","%s{dlpdict}","%s{location}","%s{dept}","%s{cip}","%s{sip}","%s{reqmethod}","%s{respcode}","%s{ua}","%s{ereferer}","%s{ruletype}","%s{rulelabel}","%s{contenttype}","%s{unscannabletype}","%s{deviceowner}","%s{devicehostname}","%s{keyprotectiontype}"

Any suggestions on how I can further troubleshoot?

[PickleRick]

I don't know this app but first thing I'd do with any such issue would be to do "open in search" on those panels and see what is the underlying search and try to see why it's not working properly. Maybe it expects other data than you have. Maybe it searches from a wrong place....