Splunk Enterprise Security

ES - Why is Network Dashboard Not Populating?

code_assassin
Explorer

Hello Splunkies, 

Having some issues with getting ES dashboards to populate... 

Query for Network Traffic Dashboard titled, "Traffic Search" : 

| tstats `summariesonly` max(_time) as _time,values(All_Traffic.action) as action,values(All_Traffic.src_port) as src_port,count from datamodel=Network_Traffic.All_Traffic where * $action_dm$ $src_dm$ $dest_dm$ $transport_dm$ $dest_port_dm$ by All_Traffic.src,All_Traffic.dest,All_Traffic.transport,All_Traffic.dest_port
| `drop_dm_object_name("All_Traffic")`
| sort - count
| fields _time,action,src,src_port,dest,transport,dest_port,count



Error I get when launching: Error in 'TsidxStats': WHERE clause is not an exact query.

Thanks in advance for the help! 

 

Labels (2)
0 Karma

meetmshah
Builder

Hello @code_assassin If you are manually running this, it will not work as there are tokens mentioned in the search. A good approach would be to click on "Submit" button and validate if it's populating the results or not. If there are no results, you will need to validate if Data Model is having the values or not.

Perhaps, is this still an issue for you?

 

Please accept the solution and hit Karma, if this helps!

0 Karma

code_assassin
Explorer

I tried to specify an index based off a similar question however no dice. 

0 Karma
Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...