Splunk Enterprise Security

Splunk ES - Toubleshooting the Web Data Model

Explorer

Hi All

I am looking for for some troubleshooting pointers for the following issue:

  1. I have Splunk Enterprise Security installed and I am currently configuring it.
  2. Receiving logs from cisco:wsa:squid
  3. Splunk ES does not recognize the tags for the Web Data Model
  4. The following searches run successfully outside of the Splunk ES App | datamodel Web Web search or (cim_Web_indexes) (tag=web tag=proxy)
  5. The same searches fail inside the Splunk ES app
  6. All TAs have been added with global permissions
  7. The Data model has had it's constraints set (cim_Web_indexes) (tag=web)

Thanks

0 Karma
1 Solution

Explorer

I believe I have discovered a solution to this problem.

Under Settings -> Event Types -> Splunk Add-on for Cisco WSA

The tag was not set for the cisco:wsa:squid event-type

Once this was changed and the Web Data Model was rebuilt, events began to populate in Cisco ES

View solution in original post

0 Karma

Explorer

I believe I have discovered a solution to this problem.

Under Settings -> Event Types -> Splunk Add-on for Cisco WSA

The tag was not set for the cisco:wsa:squid event-type

Once this was changed and the Web Data Model was rebuilt, events began to populate in Cisco ES

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!