Splunk IT Service Intelligence

Why does Splunk ITSI Web Server search no results?

batabay
Path Finder

Hi, splunkers

I am just wonder this phase. But it's not critical for me now.
I try to integrate apache web server and splunk itsi. But I stuck in creating services phase because | savedsearch DA-ITSI-WEBSERVER-WebServer_Entity_Search is not giving result.

batabay_0-1669031292819.png

 

Actually my real question is about KPI searches.
I want to show Website 4xx erros in default services page but in Website-4xx Errors search includes tag=activity, so I don't find these tag any add-on. For these reason My web site 4xx error search not working properly.

How I fix these issue ?

batabay_1-1669031302413.png

Also these tag not including in Splunk ITSI content pack.

 

batabay_3-1669031524472.png

 

Thank you.

batabay_2-1669031398321.png

 

0 Karma

skramp
SplunkTrust
SplunkTrust

So please try to figure out if your source, field extractions and permissions are correct. This must be working before creating KPIs.

0 Karma

batabay
Path Finder

Everythings is correct. Also I get logs properly. I installed apps necessary.

Which add-ons must for integrate apache and splunk itsi.

0 Karma
Get Updates on the Splunk Community!

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...

New This Month - SLO Capabilities, APM Advanced Filtering & Usage Analytics Plus ...

More for SLO Management We’re continuing to expand the built-in SLO management experience in Splunk ...

Enterprise Security Content Update (ESCU) | New Releases

In June, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...