Splunk Enterprise Security

I have mapped data in my app to the relevant CIM data model, but why do I get no search results in Splunk Enterprise Security?

alevy
Path Finder

Hi There,

I am working on an app and would like my data to be visible in the Splunk Enterprise Security dashboards.

I believe I have successfully mapped my data to the relevant CIM data model.

I can Pivot and use |tstats searches on my data from my app or the Splunk search app, however, when running the same searches in the context of Enterprise Security, I get no results.

For example, when running this search from the Search app I get the expected results:

| tstats `summariesonly` values(All_Email.protocol) as protocol, avg(All_Email.size) as avg_size, count from datamodel=Email.All_Email where *  All_Email.size>`large_email_threshold`  by All_Email.src,All_Email.src_user,All_Email.dest | `drop_dm_object_name("All_Email")` | eval avg_size=floor(avg_size) | sort 100 - avg_size | fields protocol, src, src_user, dest, count, avg_size

However, when running it from Enterprise Security, I get 0 results.

It is almost like Enterprise Security does not have permission to the Data Model (although the data model has the default settings of Everyone Read and Admin Write for All Apps).

Can anyone help with this?

Many Thanks

0 Karma
1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

Make sure that your app is being imported into ES, and that the objects in the app are being exported to ES.
http://docs.splunk.com/Documentation/ES/4.5.1/Install/InstallTechnologyAdd-ons#Import_add-ons_with_a...

View solution in original post

smoir_splunk
Splunk Employee
Splunk Employee

Make sure that your app is being imported into ES, and that the objects in the app are being exported to ES.
http://docs.splunk.com/Documentation/ES/4.5.1/Install/InstallTechnologyAdd-ons#Import_add-ons_with_a...

alevy
Path Finder

Thank you, I renamed my app and all is working now!!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...