my regular user (who is actually a member of splunk admins also) does get results when running "tag=web" The Web datamodel is set to Everyone Read AND Write. my regular user can see RealTime stats on the App dashboard, but if I select, for instance, Traffic->Traffic Center, none of the dashboards return any results. Opening 1 Dashboard in Search, I try to cut the query down to any part that actually returns results. This full query (from the Traffic dashboard, top left, Request Count By Type) returns no results: | tstats summariesonly=t prestats=t count AS Requests FROM datamodel=Web WHERE Web.site="*" "Web.eventtype"=pageview OR "Web.eventtype"=non-pageview GROUPBY "Web.eventtype" _time span=1h | search Web.eventtype=pageview OR Web.eventtype=non-pageview | timechart span=1h count by Web.eventtype This edited query DOES return results: | tstats count AS Requests FROM datamodel=Web WHERE Web.site="*" "Web.eventtype"=pageview OR "Web.eventtype"=non-pageview GROUPBY "Web.eventtype" _time span=1h | search Web.eventtype=pageview OR Web.eventtype=non-pageview | timechart span=1h count by Web.eventtype Does this provide info on where my permissions may be misaligned? summaries? prestats? I'm not familar. FYI - Today I even rebuilt the Data Model using my regular user login, per the Documentation page (turn off accelleration, re-run Generate Sessions, turn on accelleration, run "Rebuild" - it did not change the behavior. Thanks, ... View more

Great progress overnight as the data models built - I'm able to see nearly everything I've tried and I believe it's good except for some more setup and configuration. However, now I am having a permissions issue. I installed/configured the app as user "admin". Now my other users cannot see data on the dashboards, pages, or features. My normal user is a member of "admin" (and power_users, etc), so that user should be able to see everything "admin" can. I have edited app permissions to everyone read, and everyone write, still no results. I can see data and results on the realtime page, but none of the other dashboards return any data. Thanks again for the help so far, good looking app now that I can see some data. ... View more

Update: Today I scanned all my splunk servers and changed all old references to sourcetype=iisw3c to sourcetype=iis. I commented out any old usage of props or transforms associated with these sourcetypes. Basically, since 6.x now natively supports w3c better than pre-6.x, I removed all old conf entries and made it "default" to match 6.x version. I am now seeing initial data - uninstalling and reinstalling your app let me save a website quickly, get green checkmarks in a few places on the setup/documentation page(s). I am already seeing a few hits on "real time" dashboard, and the "generate pages" tool is currently running and finally showing entries - it has never, until now, even gotten the first entry. So....very good progress today. I will update this after some deeper research but I suspect it will fall in line correctly. For anyone else having this issue, if you have upgraded from a pre 6.x splunk installation, or if you have used older iisw3c props or transforms, you might want to convert these to the newer standard iis sourcetypes. Thanks! ... View more

I'm starting to realize I have a possible conflict with sourcetypes from UF, to HWF, to Indexer, to Search head. My Splunk infrastructure has been upgraded more than once and the new (6.0+) sourcetypes for IIS vs IISW3C are different. I suspect I have old methods conflicting with new. I say this because if I go just to my index (not within the app) and search "sourcetype=iis" I get different results than if I search "sourcetype=iisw3c" and the results are not necessarily consistent. For what it's worth, sourcetype=iisw3c DOES return results and DOES have a LOT of fields, most of the ones your FIELDALIASEs are looking for. I'll report back when I've confirmed consistent sourcetype data from end to end on my side. ... View more

That's very helpful, thank you. I am beginning to understand and see how the underlying changes should be working, and I feel I'm almost there, or getting closer. The only place "http_request" appears in my entire \etc directory is in the $SPLUNK_HOME\etc\apps\SplunkAppForWebAnalytics\default\props.conf file Here are the contents of that section for iis in cs_Referer EVAL-http_referer = if(isnull(cs_Referer),"-",cs_Referer) FIELDALIAS-clientip = c_ip AS clientip FIELDALIAS-cookie = cs_Cookie AS cookie FIELDALIAS-http_user_agent = cs_User_Agent AS http_user_agent FIELDALIAS-bytes = cs_bytes AS bytes FIELDALIAS-http_method = cs_method AS http_method FIELDALIAS-uri_query = cs_uri_query AS uri_query FIELDALIAS-cs_uri_stem = cs_uri_stem AS uri FIELDALIAS-uri = cs_uri_stem AS http_request FIELDALIAS-user = cs_username AS user FIELDALIAS-version = cs_version AS version FIELDALIAS-status = sc_status AS status EXTRACT-file = .*/ in cs_uri_stem ... View more

If I open the "generate pages" in search, I see this: eventtype=pageview [| inputlookup WA_settings | fields value | dedup value | rename value AS site] | top limit=100 http_request by site | fields site http_request | table site http_request | outputlookup WA_pages createinapp=t If I cut that back to see which piece works, it returns no results because of "http_request" Searching the app objects, I see "http_request" as an access_comb* extraction - that seems to be Apache, not IIS. I don't see a comparable IIS extraciton, object, or setting for the equivalent "http_request". I am running IISW3C extended format, with every value selected and every value being ingested in splunk. ... View more

grr. forum formatting fail. i have path-to-button-slash-button.jpg ( you probably got what I meant already) - full relative path, not just the actual filename. ... View more

Thanks. It's not optimal yet but I extracted the field "file" as the entire uri_stem. Instead of "button.jpg" as the "file" i have \path\to\button.jpg - if I can get the basics working I can fix that field extraction. However, the eventtype=pageview is still not working out of the box due to "status=200" is not showing up. I have manually edited to include "OR sc_status=200". I now finally see some (not entirely valid) data on "Real Time" dashboard, and I'm currently running "Generate Pages" and "Sessions" for last 30 days to see if they can complete and get me the KV extracts for the data. Getting closer I hope. Once I get the little things sorted out, I will likely remove/reinstall and do it clean from scratch (if that's needed). I'll let you know, and thanks for the reply. ... View more

Deleted, reinstalled as the main splunk admin onto my search head. Setup -> Websites, page already had log names/sourcetypes loaded(loading) in the right hand pane Added 1 Website - waited - huge font "Website saved successfully" Searched "tag=web" - got hits Still no "file" event type Went to eventtypes, copied this and ran it from search - eventtype=web-traffic status=200 NOT (eventtype=web-uri-nonpage OR eventtype=ua-bot OR eventtype=exclude-pageview OR eventtype=clientip-internal) (http_method=GET OR NOT http_method=*) That search returned 0 results changed to (status=200 OR sc_status=200) and it DID return results Same behavior as I mention in posts above Why is the file extract not working? Why is the fieldalias for status<=>sc_status not working? ... View more

I now also see a bit more deeply into the inner workings of the app. THe FieldAliases are there for the issues like status and sc_status, but without my adding that manually into the eventtype, status=200 always returned no results. Also the props-extract for iis : EXTRACT-file is not working at all, it's not pulling out "file" from any events. Not sure where to go from here. PS: my user is a splunk admin (and power user, and others - I have full access). I'm going to disable, delete the app, and reinstall again as the splunk admin just to see if behavior is any different. I'd love to get this working and help others so any info you need from me just ask and I'll try to provide. ... View more

I'm having the same/similar issues. 6.3.2 running v1.6 of the app. tag=web returns results there is no "file" eventtype there IS a pageview eventtype generate lookups returns no results audit data model also returns the same URI REST Endpoint error as above I do have file entries in the raw log data (ex: button.jpg, search.aspx on the URL's), yet there is still no "file" eventtype dashboards all return "no results found" my index is non-default. my index IS listed in the user permissions (ROLES) section for my user and the app - I even manually added index=myindex to the eventtypes to force it also, eventtype=pageview failed because it was looking for "status=200". Initially, my status codes were returning only "2" and "0" (yesterday). Today (this morning) I now see normal http codes 200, 404, 401, etc. HOWEVER they are extracted as "sc_status" and NOT "status". I then modified the pageview syntax as such: from "status=200" to "(status=200 OR sc_status=200)" I also find it odd that "eventtype" lists 100% for each event, on every eventtype. Also, in Event Types, the first item listed contains a field that I don't have anywhere else: web-traffic-external eventtype=web-traffic NOT eventtype=web-agent-nonpublic Specifically, I do not see "web-agent-nonpublic" defined anywhere in my app. I'm optimistic that we're close, but I seem to be broken at some very early step (no "files" eventtype, lookups return nothing, etc). Any help? ... View more