I have recently downloaded and installed the splunk for bluecaot app, and i'm having some difficulty adapting it. We are using the legacy proxySG (5.4) so I have usedthe bcreportmain_v1_old transofrm to extract the necessary fields, and this is working properly.
I am having difficulty with some of the other views however, and it seems to be the views that are attempting to utilize the 'tstats' command in the search. take for instance the 'Bandwidth Savings' view. I see absolutely no results, so in troubleshooting I have opened the .xml to see what the search query looks like that this dashboard is using. I put that into a regular search to see if it returned some results, but it returns nothing at all. all searches for this view exhibit the same behavior.
Please take a look. this is for the "Requests" count. The very first result set on the page.
| tstats sum(bytes_in) AS sbi FROM bluecoat_stats | eval mb_in=round(sbi/(1024*1024), 2) | fields mb_in
I've never used the 'tstats' command before, so I'm unfamiliar with it's function, however after viewing the documentation, it looks like this query is attempting to call a named series of data to present statistics on it.
I am in an attempt to figure out what loads the "bluecoat_stats" data block, because it would seem that it may be broken, or needs some tweeking to make it work.
Any suggestions would be greatly appreciated!