I have mapped data in my app to the relevant CIM data model, but why do I get no search results in Splunk Enterprise Security?

[alevy]

Hi There,

I am working on an app and would like my data to be visible in the Splunk Enterprise Security dashboards.

I believe I have successfully mapped my data to the relevant CIM data model.

I can Pivot and use |tstats searches on my data from my app or the Splunk search app, however, when running the same searches in the context of Enterprise Security, I get no results.

For example, when running this search from the Search app I get the expected results:

| tstats `summariesonly` values(All_Email.protocol) as protocol, avg(All_Email.size) as avg_size, count from datamodel=Email.All_Email where *  All_Email.size>`large_email_threshold`  by All_Email.src,All_Email.src_user,All_Email.dest | `drop_dm_object_name("All_Email")` | eval avg_size=floor(avg_size) | sort 100 - avg_size | fields protocol, src, src_user, dest, count, avg_size

However, when running it from Enterprise Security, I get 0 results.

It is almost like Enterprise Security does not have permission to the Data Model (although the data model has the default settings of Everyone Read and Admin Write for All Apps).

Can anyone help with this?

Many Thanks

[smoir_splunk · Accepted solution]

Make sure that your app is being imported into ES, and that the objects in the app are being exported to ES.
http://docs.splunk.com/Documentation/ES/4.5.1/Install/InstallTechnologyAdd-ons#Import_add-ons_with_a...

[alevy]

Thank you, I renamed my app and all is working now!!!