Splunk Enterprise Security

Why my Network Dashboard wont load data on Splunk Enterprise Security?


I am setting Splunk ES and sending data from Fortinet. Data is well parsed and CIM compatible however Network dashboards are not loaded.

After digging in macros I found that a particular command is stopping the dashboards to load.

Below is the query when I expanded all the macros.

| tstats prestats=true local=tstats_local summariesonly=true allow_old_summaries=allow_old_summaries_bool count from datamodel=Network_Traffic.All_Traffic where * by _time,All_Traffic.action span=10m
| timechart minspan=10m count by All_Traffic.action
| drop_dm_object_name("All_Traffic")

If I change summariesonly to false then dashboards are loaded well. I read that summariesonly=true will only work if the datamodel is accelerated and in this case it is already accelerated and hence should work.

Anyone else faced the issue???

0 Karma


bumping the post

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>