Hi You need to enable replication for the KVstore so it is sent out to the indexers. Datamodel acceleration is performed on the indexers and if the lookup isn't there it won't work. Your collections.conf [A] replicate = true accelerated_fields.A = {"A": 1,"B": 1,"C": 1} [B] replicate = true accelerated_fields.B = {"B": 1} j ... View more

Hi hatbeard Can you try and add this to the realtime dashbord? It will limit the search to just the sites in the config eventtype=pageview site="*" [| inputlookup WA_settings | rename value as site | fields site] j ... View more

Hi hatbeard The real-time dashboard uses this base search to produce the output: eventtype=pageview site="*" It should show you all data that matches that search and not limited to just the sites you have configured under website setup. the only caveat is that each event needs to have the site field present and filled out. For some web log configurations this field is already part of the log file (as you mentioned) and will be present event though you haven't configured it. Let me know you get along j ... View more

Hi kc5ods There is currently no way of extracting organizations from a URL or domain. This could be made possible using a lookup that you can create and attach to the source data. It should then be relatively easy to add a couple of panels that groups the traffic by this new field. As for the exclusion of images and other files - This should already be part of the app? This is done using event types and by checking the "file" field for various extensions. Can you double check that you have the field called "file" when doing this search: tag=web If not, perhaps you can tweak the "file" field extraction until you have this field? j ... View more

Hi Jim The app has not been tested in a search head clustering environment but it ought to work. The app does not use any particularly strange configurations. Just some scheduled searches, a summary index, lookups and a data model. If it gets tested I will let you know. j ... View more

Hi hylam There is a Data Model Audit dashboard under Setup. You can also check all the other dashboards (except Real-Time) to see when the last bit of data was put in the data model. j ... View more

Hi hatbeard Can you check this thread? All objects in the app was moved to "app" visiblity instead of global and some other users reported issues. http://answers.splunk.com/answers/316288/splunk-app-for-web-analytics-eventtype-not-found-o.html#comment-317468 j ... View more

Hi hylam If you are running 12 cores, 12gb ram and you still can't get this to work with 10gb of data for 7 days there must be something else at play here. I'm running more than that volume on my consumer grade laptop. Perhaps you can modify the eventtype=web-traffic to contain an index filter? To answer some of your questions about the app: Where in the code does it consume WA_sessions.csv or WA_pages.csv and write to data model? Sessions - This is done in the data model which is update every 10 minutes. Check the Data Model Audit dashboard. Pages - This is just used for some dropdowns. It's not essential for the functionality of the app. WA_pages.csv is truncated regularly. WA_sessions.csv keeps growing as I add data. How much does it scale to? Sessions - This process keeps 72 hours worth of data in the lookup file. The rest is truncated on every scheduled search if the session has been moved into the data model. If you haven't enabled data model acceleration yet, it will keep all data in the session lookup. j ... View more

Hi hylam You are right, 10gb is not very much for Splunk. I wrote the app and have loaded bigger data sets on my Macbook Air than what you have tried here. I don't think it is a good idea to rewrite the Generate Sessions search as its highly tuned to work exactly as it is, to offload data into a lookup which is then read into a datamodel that drives the dashboards. Running that search every time a dasboard is loading won't work so we run it in scheduled batches. The search is using the transaction command to create sessions and that puts heavy load on the search head CPU. The shortage of RAM could also be an issue here. To get around the browser timeout issues I propose this - Change the initial run of the Generate Sessions to only search for the last 7 days - by default its set to All Time. - After the search has kicked off, select "Send to background" in the drop down menu for the search. Splunk will either send you an email when its done (if you have that configured) or let you know in the activity menu if the job is done. The scheduled searches are running every 10 minutes with an overlapping timeperiod to catch open sessions that have not been closed yet from the previous search. You can alter the scheduled and timings within the search but do it carefully so you don't lose sessions. Let me know how you get long. j ... View more

Great! I'll add this to the troubleshooting section of the docs. Other users might experience the same thing. j ... View more

Hi hatbeard Can you try and go through the troubleshooting section that's in the documentation of the app? Can you also doublecheck that the data inputs are still enabled? Troubleshooting The lookup searches are not returning any data In the context of the app, try and do the search for: tag=web If this is not returning any results I suspect you are not seeing the data because it is stored in a non-default index and the user in Splunk does not search in non-default indexes automatically. Another issue might be that you are not using any of the pre-configured sourcetypes. See Setup point 1 above. If this is returning results, double check that each entry has the "site" field populated. It's crucial that this field exists in your data. See Setup point 2 above. All or some dashboards are returning "No results found" As the app relies heavily on data model accelerations you will not see anything in any dashboards (except the "Real-Time" ones) until this acceleration has completed. Initially this could take a while. There is a "Data Model Audit" dashboard that will tell you if the acceleration is complete or not. ... View more

Hi James I see two things that can cause this. With version 1.42 I moved all objects to "App" visibility. Before they were Global. If you have a dashboard outside the scope of the app, the eventtypes will not work. You can get around this by manually going to the eventttypes and changing the Permissions to Global for these two eventtypes. The changes you applied last time to fix that issue might interfere with the new version of the app. Perhaps you can modify the local files in SplunkAppForWebAnalytics to revert the changes? j ... View more

Hi eckdale I recently launched a new version - 1.41 - This has improved support for IIS. There were some bugs with the previous version so I recommend you upgrade. https://splunkbase.splunk.com/app/2699/ j ... View more

Hi kc50ds Can you check that your scheduled searches are running? These are creating lookups that are then fed into the datamodel that produces the data for the dashboards. If the scheduled searches are running, can you also check that the datamodel is enabled? There is a new version of the app - 1.41 - that has a vastly superior documentation and setup page. After upgrading, go to the Documentation page and check that all checkboxes are green. That page also includes trouble shooting steps. https://splunkbase.splunk.com/app/2699/ j ... View more

Hi eckdale Are both lookups failing or just the Sessions one? The Pages lookup is very simple: eventtype=pageview | table site http_request The Sessions is much more complicated and uses the transaction command and is reliant on the "site" field being present. In the context of the app, try and do the search for: tag=web If this is returning results (which you are saying it does), double check that each entry has the "site" field populated. If not, the Session lookup will not work. Can you try this and report back what you get? j ... View more

Hi mrgibbon I suspect the site is configured wrong and the site field is not being applied to the source and host combination. There is a new version of the app (1.4) which greatly enhances the setup process with visual cues (green check marks) if it is configured correctly. It also includes a troubleshooting section that details some steps to follow. https://splunkbase.splunk.com/app/2699/ j ... View more

Hi Brandonf Thanks for reporting this in. There were a also few users who noted this. There is a new version of the app (1.4) which fixes this issue and adds on some new functionality. https://splunkbase.splunk.com/app/2699/ j ... View more

To troubleshoot this, do the same as before. Run a search for this: tag=web If you don't get results that are after 8pm on monday, august 10 the data inputs are configured in-correctly. This is outside the scope of the app and you need to sort that out by modifying the data inputs. If you do see data after 8pm on monday, august 10 you might have the sites mis-configured. Run a search for this: tag=web site=* If you don't see data after 8pm on monday, august 10 you need to configure your sites properly. The source log files might have rolled over to a new file that is not being picked up by the host and source pattern? There is a guide on the site page that should help you. You can see all host and source combinations currently in the data and if you have a site configured to match this. j ... View more

Hi lauMArot This is optional. If you configure this there will be an eventtype called clientip-internal that you can use for searching. No dashboards are currently using this but might do in the future. j ... View more

Can you detail the host and source fields for your data when you search for tag=web ? Can you also then show what you have filled out in the site setup page? I will try and help you configure this if I get the details. j ... View more