×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
ranafge
Loves-to-Learn
Member since: 2 weeks ago
Monday
Community Statistics
Posts 5
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎04-26-2025
View All

Re: No Vulnerability Detection Data Appearing in S...

by in Dashboards & Visualizations
a week ago
a week ago
Hi @livehybrid, Thanks for your response. Yes it is JSON structured data but there is not data like data -> vulnerability -> severity. How can i send you root cause analysis data? sample data : {"timestamp":"2025-04-29T12:44:53.812+0600","rule":{"level":5,"description":"Systemd: Service exited due to a failure.","id":"40704","firedtimes":4,"mail":false,"groups":["local","systemd"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"001","name":"debian-pc","ip":"192.168.11.XX"},"manager":{"name":"ubuntu"},"id":"1745909093.11585380","full_log":"Apr 29 06:44:53 proxmox systemd[1]: logstash.service: Main process exited, code=exited, status=1/FAILURE","predecoder":{"program_name":"systemd","timestamp":"Apr 29 06:44:53","hostname":"proxmox"},"decoder":{"name":"systemd"},"location":"journald"} ... View more

Re: No Vulnerability Detection Data Appearing in S...

by in Dashboards & Visualizations
2 weeks ago
2 weeks ago
Hi @livehybrid  First of all, thanks for your response. When I search using index="wazuh-alerts", I get lots of events. For the search index="wazuh-alerts" "Medium", I get 7 events. ... View more

Re: No Vulnerability Detection Data Appearing in S...

by in Dashboards & Visualizations
2 weeks ago
2 weeks ago
Hi @livehybrid  First of all, thanks for your response. When I search using index="wazuh-alerts", I get lots of events. For the search index="wazuh-alerts" "Medium", I get 7 events. ... View more

Re: No Vulnerability Detection Data Appearing in S...

by in Dashboards & Visualizations
2 weeks ago
2 weeks ago
First of all thanks for your reply. I ran the following search in Splunk: index="wazuh-alerts" "data.vulnerability.severity"="Medium" | stats count I also tested for other severity levels like "High" and "Low," but the result was always 0. This indicates that no vulnerability detection events are being indexed in Splunk. Even though other types of data are coming through, there are currently no events where data.vulnerability.severity is populated with "High," "Medium," or "Low." It suggests that either: Vulnerability Detector is not generating results, The events are not being forwarded to Splunk properly, Or the events are being indexed but under a different sourcetype, index, or field structure. Would appreciate any guidance on how to dig deeper into this! ... View more

No Vulnerability Detection Data Appearing in Splun...

by in Dashboards & Visualizations
2 weeks ago
2 weeks ago
Hello Splunk Community, I'm seeking help regarding an issue I’m facing. The main problem is that vulnerability detection data is not showing up in my Splunk dashboard. Wazuh is installed and running correctly, and other data appears to be coming through, but the vulnerability detection events are missing. I've verified that: Wazuh services are running properly without critical errors. Vulnerability Detector is enabled in the Wazuh configuration (ossec.conf). Wazuh agents are reporting other types of events successfully. Despite this, no vulnerability data appears in the dashboard. Could someone guide me on how to troubleshoot this? Any advice on checking Wazuh modules, Splunk sourcetypes, indexes, or forwarder configurations would be highly appreciated. Thank you in advance for your support! ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
Monday