All Apps and Add-ons

Splunk App for Web Analytics v1.7 Lookups Not Populating

kjhanson
Path Finder

Hello,

I'm currently running the latest version of the Web Analytics app. For some reason, the lookups do not populate user session or pages data. The validation tool within the documentation page are showing that the tagging is correct, the website configuration is correct, and the data model is accelerated. I've modified all the permissions on the app to be available to everyone and all apps, and changed the indexes searched by default to my role. So I'm fairly certain it's not a permissions issue at this point.

Does anyone know why it's not working? Is there a certain level of logging that may need to be enabled on the web server itself? I've gone into the actual data model itself, and tried previewing the lookups and they still turn up empty even though the raw data is there.

0 Karma

jbjerke_splunk
Splunk Employee
Splunk Employee

Hi

Make sure that when you search for

tag=web

you get the field eventtype with values of pageview

The app excludes non-pageviews from the datamodel as these are not used for web analytics.

If you are not getting any pageview events look into your field extractions to make sure they are working. Specifically, I have seen some issues with the field "file" not being extracted properly which has caused this issue.

You should also make sure that you get results when you run the "Generate user sessions" lookup and let this complete before you enable data model acceleration.

J

0 Karma

atsf
New Member

I have the same problem. tag=web is showing pageview event types and I get results when running "Generate user sessions"

Also: I have authenticated users in my logs but the Splunk user field is showing what seems to be a hash value not my user ID. Any suggestion?

Thanks

0 Karma

jbjerke_splunk
Splunk Employee
Splunk Employee

Your problem description is not the same as the original post. The original post did not get the lookup working, but yours do. Can you check the documentation troubleshooting steps or from other Splunk Answers posts?

As for the user field, the app generates a hash value for the user as this usually not present in the web logs. To use your user name field, disable the "Calculated field" user under Settings->Fields or by modifying the props.conf file in the app directory. Look for the EVAL-user... line.

j

0 Karma

atsf
New Member

"Calculated field" user under Settings->Fields doesn't allow deletion but I modified the conf file as suggested and, after restart, that's done the trick ... thanks.

I haven't found a Splunk Answers post to help with the missing dashboard results (apart from Real-Time. I will look for the troubleshooting info in the documentation.

0 Karma

john_glasscock
Path Finder

I am having the same issue. Realtime dashboard is working, but since the lookups are not being populated, non of the other dashboards are working.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...