Thanks For Downloading!
Review the documentation below and follow any custom installation steps. If no install steps are listed, most Splunk Apps and Add-ons can be installed as follows:
Unix/Linux: Decompress the downloaded file using a tool like
Remotely monitor and troubleshoot Websense Web Security (WWS).
Exponant offers Splunk Professional Services worldwide:
Versions and Release Notes
Version 2.1 (current version - updated Jan 10, 2013)
- Updated to work with Splunk 5.x
Version 2.0 (updated Aug 08, 2012)
Setting up this app:
Version 1.0 (updated Nov 18, 2011)
Very handy app... well done!!
reviewed 05 Oct '12, 04:04
accept rate: 0%
Nice app, the dashboards are clean and leverage summary indexing to remain scalable even when a large amount of WebSense data has to be iterated through.
A few remarks :
The scripted input stanzas in websense_forwarder/default/inputs.conf reference an incorrect path and won't run without modification :
...should be :
It would be nicer to package the websense_forwarder mini-app as a Technology Add-on rather than including it in the main app.
LINE_BREAKERconfiguration for the
websense-ss-pingm1sourcetypes in props.conf are not correct. To ensure that the output of each script run is indexed as a single event, I would rather recommend the following configuration :
SHOULD_LINEMERGE = false LINE_BREAKER = ^()$ TRUNCATE = 1000000 DATETIME_CONFIG = CURRENT
EXTRACTsearch-time field extractions in websense_forwarder/default/props.conf are unnecessary as they will never be used on a forwarder and should be removed.
It would be nice to document the different invocations of
fill_summary_index.pythat the user has to run in order to backfill the summary indexes that power some of the dashboards. Ideally, you could advertise the need to run these backfill commands on the dashboard itself so that the user understands why no data is displayed.