If ES loaded the data into the data models before you installed the splunk_TA_cisco-asa on the ES Search Head, these values will show as unknown. You need to rebuild the data model for this to be corrected. You should browse the data model and confirm that the data is tagged correctly however. Follow the ES documentation based on your datamodel and dashboard : http://docs.splunk.com/Documentation/ES/3.1.1/User/AdditionalNetworkdashboards http://docs.splunk.com/Documentation/CIM/latest/User/Howtousethesereferencetables ... View more

If you have SHC configured, you need 3 search heads, you can follow the Documentation for deploying ES in SHC. It will involve all SA-* SplunkforEnterpriseSecurity* DA-* folders. ... View more

You need a metadata directory with a default.meta file that has this in it: [] access = read : [ * ], write : [ admin ] export = system ... View more