All Apps and Add-ons

Cisco WSA dashboard not displaying some data

kevindsomers
New Member

I have a new install of Splunk 6.1.1 and have installed the Cisco Security Suite app as well as the Web Security Appliance (WSA) app. The Splunk server is running Windows Server 2008 R2 and is running FTP. One WSA has a log subscription sending the access logs to the WSA.

When I look at the Web Security overview, there is data in Web Security Events, but only errors. The "Proxied Reuests by Category" is empty, and I know from looking at the logs that the category is there. In the "Acceptable Use: Personal Use" the personal use vs other graph shows two values. In order to populate this it must know the category, but again the Top Categories graph says no results found.

Why would this be missing and how do you fix it?

0 Karma

ocfosecdc
New Member

The line for this lookup goes into which config file? Looking at your main dashboard config file for the WSA add on does not have a line available for this lookup.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

For some reason the lookup table isnt applied to extract the fields.

lookup cisco-wsa-category x_webcat_code_abbr OUTPUT x_webcat_code_full  |

If you add that to the saved search for the main dashboard in SA-cisco-wsa, it will populate based of of the x_webcat_code_full categories for Proxied Request. The lookup table should already be defined, however you should check by doing a

| inputlookup cisco-wsa-category

That should get the main dashboard populating and you can get the drilldowns going with that. Let me know if you need more help.

Cheers

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...