Splunk Enterprise Security

[PCI]Compliance Status History Scorecard In PCI Compliance -Not Rendering Data

rbal_splunk
Splunk Employee
Splunk Employee

VERSION=8.0.6
ES version= version = 6.1.0
Splunk_DA-ESS_PCICompliance=4.1.0
Issue is for the “PCI Compliance Posture” dashboard the View “Compliance Status History” is not showing data. It just displaystag_error.png "Unable to find tag filtered"

Labels (1)
0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

This isn't an issue. We ship with references to tag=filtered, but we don't explicitly filter anything out of the box.For, now you can replace panel's search query in pci_posture.xml with below search query and the customer can see events in the panel:

 

Spoiler

index="pci_posture_summary" search_name="PCI - Compliance Status History - Summary Gen"  | `makemv(orig_tag)` | `mvappend_field(tag,orig_tag)` | extract kv_for_pci_compliance_status_history_summary | timechart span=`pci_compliance_history_span` latest(All) as All

What we have done here is we have removed the filtering condition from the search query.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...