Preset Cisco WSA - Acceptable Use - Business - Recent Events returned no value

[thinguyen]

Hi When I ran this preset , there was no results diplayed.

What was wrong?

[Will_Hayes]

Hi Thinguyen, The most likely reason is you do not have any data in your index where the lookup value on the indexed categories match the Business as the usage field. If you run this search eventtype=ironport_proxy | top usage, you will get an idea of the types of usage you have indexed in your WSA logs. I also recommend grabbing v4.1.1 of the app which was released on 4/27/10. Please let us know if this does not answer your question.

[Simeon]

Is this a search you were running? It sounds like you need to manually breakdown the search into pieces to see which portion is/isn't supposed to return data. If you can edit your question to be more detailed that will be helpful.