All Apps and Add-ons

Web intelligence App - backfill summary indexes not showing any data in reports/ dashboards

raghukodali
Engager

I am trying to use Web intelligence app on Splunk 5.x with a standard Apache logs (access_combined) that have all required fields.
In the setup screen, I can see the data indexed with sourcetype="access_c*".
After running backfill scripts, I don't see any data out of the reports/dashboards in the App.

Here are the checks I have done so far
- Make sure that the license is available
- I have edited events.conf to make sure the sourcetype is properly set
- looked in $SPLUNK_HOME/var/spool/splunk directory but did not see any files over there
- I see ERROR UserManager - Error while setting user context: Could not get info for non-existent user="nobody" in splunkd.log
- I checked the user has access to the indexes created by backfill scripts
- the general search is showing the events

Any tips or pointers on how to get the app working ?

-raghu

macycron
Explorer

Try changing the app configuration. In the Web intlligence app, go to setup. In the sourcetypes field, put the name of the index that contains your web logs. Example: instead of sourcetype=access_combined put instead index=yourweblogs.

0 Karma

hexx
Splunk Employee
Splunk Employee

That explains why your summary indexes are not populating. At this point, you're going to need to decompose those searches to understand why they are not returning results. Are they failing to find the expected events? Are they failing to find the expected fields? Unfortunately, there is no easy recipe here. You have to use trial and error.

raghukodali
Engager

Went to Manager -> Searches and saw Reports for Web Intelligence app, there were 124 listed searches. What I could find out is the searches which aren't scheduled and not summarized like "New Visitors Lookup" are showing results.
All the other searches which are scheduled, and have SI and where the searches have index="wi_summary_daily" / "wi_summary_hourly" / "wi_summary_fivemin" are not showing any results.

0 Karma

hexx
Splunk Employee
Splunk Employee

If you manually run in the flashtimeline the searches that are intended to regenerate the summary indexes, do these return any results?

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...