Splunk App for Enterprise Security: Why are all dashboards and reports empty even with the Splunk Add-on for Microsoft Windows installed?

[FRoth]

I installed the Splunk App for Enterprise Security, but all dashboards and reports are empty. The Splunk_TA_windows Add-on is installed and "indexes.conf" contains the index "windows" that has 20 GB of current log data coming from Splunk Universal Forwarders in our environment. It's a single system deployment processing about 1-2GB of Windows events per day.

It looks like every search/report is empty. I've seen that some data has to be tagged with "web" or "proxy" to appear in the dashboards. I checked the "tags.conf" of the "Splunk_TA_windows" and it seems that all the events in the "windows" index are tagged with "windows" automatically.

The user "ess_user" has access to all non-internal indexes. I even added the index "windows" to the indexes that should be searched by default.

I haven't filled the "lists and lookup" CSVs so far. Could this be the problem?

How comes that all views are empty?

[ekost]

The panels and other visualizations in ES require data that's been normalized into the data models and accelerated. One way to isolate and test the acceleration is by dropping the summariesonly macro from the search string above. If the accelerations have not finished but the data is normalized properly, dropping summariesonly macro should reveal numbers in the "current_count" and "delta" stats. The Data Model Audit dashboard is another tool for looking at the overall status of the data model accelerations.

[amielke]

1. Check the permissions on the field and the dashboards.
2. Check the time interval of the data, may be the search is out of time.