Splunk Enterprise Security

[PCI]Compliance Status History Scorecard In PCI Compliance -Not Rendering Data

rbal_splunk
Splunk Employee
Splunk Employee

VERSION=8.0.6
ES version= version = 6.1.0
Splunk_DA-ESS_PCICompliance=4.1.0
Issue is for the “PCI Compliance Posture” dashboard the View “Compliance Status History” is not showing data. It just displaystag_error.png "Unable to find tag filtered"

Labels (1)
0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

This isn't an issue. We ship with references to tag=filtered, but we don't explicitly filter anything out of the box.For, now you can replace panel's search query in pci_posture.xml with below search query and the customer can see events in the panel:

 

Spoiler

index="pci_posture_summary" search_name="PCI - Compliance Status History - Summary Gen"  | `makemv(orig_tag)` | `mvappend_field(tag,orig_tag)` | extract kv_for_pci_compliance_status_history_summary | timechart span=`pci_compliance_history_span` latest(All) as All

What we have done here is we have removed the filtering condition from the search query.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...