Splunk Enterprise Security

Why my Network Dashboard wont load data on Splunk Enterprise Security?


I am setting Splunk ES and sending data from Fortinet. Data is well parsed and CIM compatible however Network dashboards are not loaded.

After digging in macros I found that a particular command is stopping the dashboards to load.

Below is the query when I expanded all the macros.

| tstats prestats=true local=tstats_local summariesonly=true allow_old_summaries=allow_old_summaries_bool count from datamodel=Network_Traffic.All_Traffic where * by _time,All_Traffic.action span=10m
| timechart minspan=10m count by All_Traffic.action
| drop_dm_object_name("All_Traffic")

If I change summariesonly to false then dashboards are loaded well. I read that summariesonly=true will only work if the datamodel is accelerated and in this case it is already accelerated and hence should work.

Anyone else faced the issue???

0 Karma


bumping the post

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...