All Apps and Add-ons

Splunk App for Web Analytics and Splunk Weblog Add-on: Why is no data returned from the lookups?

hoopydave
Path Finder

We installed these apps on our search head. We followed the instructions installing Splunk Weblog Add-on and it is enable, Sourcetype for our data is iis. The host and source don't show in the Available host and source combinations. I can manually search from the Splunk search app and see the data is there, but the Lookups come back with 0 records found.

0 Karma
1 Solution

hoopydave
Path Finder

As is tums out, the role we are in did not have the correct searching capabilities in Splunk. We needed to add All non-internal indexes to the Selected indexes in Access controls » Roles » [ROLE NAME]. We only had MAIN selected. Once we added that, we were able to see data.

View solution in original post

fausap
Explorer

Hello,
I had some problems too.

I configured the app, with 3 months of data, and I also accelerated the dataset without any problem, but when I go to Analytics dashboard, I can see only the data for the current day.
The "generate user sessions" and "generate pages" lookups ran successfully displaying the entire period of 3 months.

Any idea about this odd behaviour ?

thanks,
Fausto

0 Karma

hoopydave
Path Finder

As is tums out, the role we are in did not have the correct searching capabilities in Splunk. We needed to add All non-internal indexes to the Selected indexes in Access controls » Roles » [ROLE NAME]. We only had MAIN selected. Once we added that, we were able to see data.

sinash
Explorer

Self-experience: Even if you're using the admin account, you have to add All non-internal indexes and All internal indexes to Indexes searched by default.

0 Karma

jbjerke_splunk
Splunk Employee
Splunk Employee

Hi hoopydave

The search powering the panel in the Website configuration looks like this:

| tstats prestats=t count where index=* by host,source | stats count AS events by host, source | search host=*"*"* OR source=*"*"*

Make sure that the search returns something. If not, can you try and running the search:

tag=web

and see if that returns something.

Please note that Splunk app for Web Analytics will only work on Splunk version 6.2 and higher.

j

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...