Hello there.
I'm having another issue with the Splunk App for Web Analytics... but I'm not sure where the problem is.
I created a script that download some data and put this data in a directory. Then, Splunk gets this data in a batch mode and indexes it in some index. On the other hand, I have configured the WebAnalytics App and works fine, but seems to have some problem between the automatically indexed data and the datamodel because the panels go crazy and don't show real data... it's like they can't get data from the datamodel... or even this data was corrupted. With this context, I have done some tests:
-- All is fine in the script logs
-- All is fine in the splunkd.log
-- When I do the search in the datamodel, I can't get any results (seems to be some fields empty)
-- I restart the splunk deployment, without any difference
-- When I rebuild the datamodel, the results are even worse
-- When I use the Pivot to see the datamodel, some fields that has data before, now are empty (**http_session**, **http_locale**,**http_session_channel**, **http_session_duration**, **http_session_end**, **http_session_pageviews**, **http_session_referrer**, **http_session_referrer_domain**, **http_session_referrer_hostname**, **http_session_start**)
-- If I delete the index with the data, create a new one and index the same data in it, after the configuration steps all works fine again.
Someone has any clue?
Regards.
↧