Why isn't Vmware carbon black cloud app dashboards populating results?

[bsanjeeva]

Hi 

We are using Vmware carbon black cloud app and the vmware logs are pulled from AWS s3 buckets. The index is having logs. However, the dashboards of the app when configured with same index is not working. Please help remediate.

Thanks

[chaker]

Hi @bsanjeeva ,

It's likley an index that is not searchable by default, or a macro needs to be updated to specify the indexes with the data.

Is this the app you are using? (VMware Carbon Black EDR On-Prem)

If so:

1. Navigate to the Administration > Application Configuration menu, VMware EDR Base Configuration tab.

   1. Update the index names to those created above

   2. Click the Save Application Configuration button to enable the App

Otherwise, open a report panel from the app in search, if it contains macro's, use the CTRL-SHIFT-E shortcut to expand the search. The problem should become a bit more obvious at that point.

[chaker]

I see that you are using the cloud app, not on prem, however similar solution most likley.

https://developer.carbonblack.com/reference/carbon-black-cloud/integrations/splunk-app/#app-setup-an...

1. Create two Event index(s) for your data.

   • One index for the Carbon Black Cloud data e.g. carbonblackcloud
   • One index for the results of the Alert Actions e.g. vmware_actions

2. Navigate to the Administration –> Application Configuration menu in the VMware Carbon Black Cloud App

3. On the VMware CBC Base Configuration tab set the VMware CBC Base Index and VMware CBC Action Index to the index names from step 1 including index= e.g. index=carbonblackcloud

4.  

[bsanjeeva]

Hi @chaker ,

We have the app installed in splunk cloud and the app used is, https://splunkbase.splunk.com/app/5332/ . I have completed the app setup with index names, but still the dashboard is not working.

Thanks