Splunk Enterprise Security

Splunk App for Enterprise Security: Why are all dashboards and reports empty even with the Splunk Add-on for Microsoft Windows installed?


I installed the Splunk App for Enterprise Security, but all dashboards and reports are empty. The Splunk_TA_windows Add-on is installed and "indexes.conf" contains the index "windows" that has 20 GB of current log data coming from Splunk Universal Forwarders in our environment. It's a single system deployment processing about 1-2GB of Windows events per day.

It looks like every search/report is empty. I've seen that some data has to be tagged with "web" or "proxy" to appear in the dashboards. I checked the "tags.conf" of the "Splunk_TA_windows" and it seems that all the events in the "windows" index are tagged with "windows" automatically.

The user "ess_user" has access to all non-internal indexes. I even added the index "windows" to the indexes that should be searched by default.

I haven't filled the "lists and lookup" CSVs so far. Could this be the problem?

How comes that all views are empty?

alt text

0 Karma

Splunk Employee
Splunk Employee

The panels and other visualizations in ES require data that's been normalized into the data models and accelerated. One way to isolate and test the acceleration is by dropping the summariesonly macro from the search string above. If the accelerations have not finished but the data is normalized properly, dropping summariesonly macro should reveal numbers in the "current_count" and "delta" stats. The Data Model Audit dashboard is another tool for looking at the overall status of the data model accelerations.

  1. Check the permissions on the field and the dashboards.
  2. Check the time interval of the data, may be the search is out of time.
0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...