I have a new install of Splunk 6.1.1 and have installed the Cisco Security Suite app as well as the Web Security Appliance (WSA) app. The Splunk server is running Windows Server 2008 R2 and is running FTP. One WSA has a log subscription sending the access logs to the WSA.
When I look at the Web Security overview, there is data in Web Security Events, but only errors. The "Proxied Reuests by Category" is empty, and I know from looking at the logs that the category is there. In the "Acceptable Use: Personal Use" the personal use vs other graph shows two values. In order to populate this it must know the category, but again the Top Categories graph says no results found.
Why would this be missing and how do you fix it?
... View more