Splunk Enterprise Security

Splunk ES - Toubleshooting the Web Data Model

Explorer

Hi All

I am looking for for some troubleshooting pointers for the following issue:

  1. I have Splunk Enterprise Security installed and I am currently configuring it.
  2. Receiving logs from cisco:wsa:squid
  3. Splunk ES does not recognize the tags for the Web Data Model
  4. The following searches run successfully outside of the Splunk ES App | datamodel Web Web search or (cim_Web_indexes) (tag=web tag=proxy)
  5. The same searches fail inside the Splunk ES app
  6. All TAs have been added with global permissions
  7. The Data model has had it's constraints set (cim_Web_indexes) (tag=web)

Thanks

0 Karma
1 Solution

Explorer

I believe I have discovered a solution to this problem.

Under Settings -> Event Types -> Splunk Add-on for Cisco WSA

The tag was not set for the cisco:wsa:squid event-type

Once this was changed and the Web Data Model was rebuilt, events began to populate in Cisco ES

View solution in original post

0 Karma

Explorer

I believe I have discovered a solution to this problem.

Under Settings -> Event Types -> Splunk Add-on for Cisco WSA

The tag was not set for the cisco:wsa:squid event-type

Once this was changed and the Web Data Model was rebuilt, events began to populate in Cisco ES

View solution in original post

0 Karma