Splunk Enterprise Security

[PCI]Compliance Status History Scorecard In PCI Compliance -Not Rendering Data

rbal_splunk
Splunk Employee
Splunk Employee

VERSION=8.0.6
ES version= version = 6.1.0
Splunk_DA-ESS_PCICompliance=4.1.0
Issue is for the “PCI Compliance Posture” dashboard the View “Compliance Status History” is not showing data. It just displaystag_error.png "Unable to find tag filtered"

Labels (1)
0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

This isn't an issue. We ship with references to tag=filtered, but we don't explicitly filter anything out of the box.For, now you can replace panel's search query in pci_posture.xml with below search query and the customer can see events in the panel:

 

Spoiler

index="pci_posture_summary" search_name="PCI - Compliance Status History - Summary Gen"  | `makemv(orig_tag)` | `mvappend_field(tag,orig_tag)` | extract kv_for_pci_compliance_status_history_summary | timechart span=`pci_compliance_history_span` latest(All) as All

What we have done here is we have removed the filtering condition from the search query.

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...