App for Web Proxies: How to troubleshoot why there is no data in the Web Proxy Traffic Overview?

[mudricd]

Hi,

I would like to analyze Sophos Web Gateway logs. I installed your app according to the provided short manual, but there are no data in web proxy traffic overview. Could you please advise on this?

Cheers,
Dragan

[esix_splunk]

You need to check your sourcetypes and make sure they match what the app is looking for. You should be able to drill into one of the searches in the dashboards, and see what its pulling from.

[mudricd]

Hi guys,

I have enabled web acceleration couple of hours ago but status is still "Building". I am not sure how long does this take.

Where can I check sourcetype for app's searches? From the search from one of the panels I cannot figure:

| web_proxy_tstats_pre count from datamodel=Web where nodename=Web.Proxy by _time,Web.action,Web.http_method span=10m | rename Web.action AS action Web.http_method AS http_method | timechart minspan=10m useother=false count by action

Thanks guys for helping me out with this!

Cheers,
Dragan

[esix_splunk]

Check in the macros for that app. That's a macro. Additionally, I would check the README.. It should say what the expected data sources are...

[dshpritz]

This is using the Web data model, so the app itself doesn't really care about data sources. As long as the proxy data is correctly tagged ("web" and "proxy") and the fields extracted are CIM compliant, any proxy data should work.

[dshpritz]

Hey Dragan,

Did you accelerate the Web data model? If so, it may take a while for it to start accelerating the data. You can check the progress by looking at the data models management page (see here).

Thanks,

Dave

[mudricd]

Do you know how long web acceleration building takes? I enabled it yesterday and status is still building...

Thanks

[dshpritz]

It can take a while, especially if you are backfilling a large amount of data. It should give you a percentage to see how far along it is.