Splunk Enterprise Security

Splunk App for Enterprise Security: Why are all dashboards and reports empty even with the Splunk Add-on for Microsoft Windows installed?

FRoth
Contributor

I installed the Splunk App for Enterprise Security, but all dashboards and reports are empty. The Splunk_TA_windows Add-on is installed and "indexes.conf" contains the index "windows" that has 20 GB of current log data coming from Splunk Universal Forwarders in our environment. It's a single system deployment processing about 1-2GB of Windows events per day.

It looks like every search/report is empty. I've seen that some data has to be tagged with "web" or "proxy" to appear in the dashboards. I checked the "tags.conf" of the "Splunk_TA_windows" and it seems that all the events in the "windows" index are tagged with "windows" automatically.

The user "ess_user" has access to all non-internal indexes. I even added the index "windows" to the indexes that should be searched by default.

I haven't filled the "lists and lookup" CSVs so far. Could this be the problem?

How comes that all views are empty?

alt text

0 Karma

ekost
Splunk Employee
Splunk Employee

The panels and other visualizations in ES require data that's been normalized into the data models and accelerated. One way to isolate and test the acceleration is by dropping the summariesonly macro from the search string above. If the accelerations have not finished but the data is normalized properly, dropping summariesonly macro should reveal numbers in the "current_count" and "delta" stats. The Data Model Audit dashboard is another tool for looking at the overall status of the data model accelerations.

amielke
Communicator
  1. Check the permissions on the field and the dashboards.
  2. Check the time interval of the data, may be the search is out of time.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!