Splunk Search

Preset Cisco WSA - Acceptable Use - Business - Recent Events returned no value

thinguyen
Engager

Hi When I ran this preset , there was no results diplayed.

What was wrong?

Tags (1)

Will_Hayes
Splunk Employee
Splunk Employee

Hi Thinguyen, The most likely reason is you do not have any data in your index where the lookup value on the indexed categories match the Business as the usage field. If you run this search eventtype=ironport_proxy | top usage, you will get an idea of the types of usage you have indexed in your WSA logs. I also recommend grabbing v4.1.1 of the app which was released on 4/27/10. Please let us know if this does not answer your question.

Simeon
Splunk Employee
Splunk Employee

Is this a search you were running? It sounds like you need to manually breakdown the search into pieces to see which portion is/isn't supposed to return data. If you can edit your question to be more detailed that will be helpful.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...