I have the Web Analytics running and I am going through and fixing the problems (since first of all it couldn't see any data) however, I've run in to a problem I cannot diagnose.
I am trying to get the dashboard working but some at not working. One of them uses this;
source="User session visitor source*"
However, nothing is returned. What is the process to find out what this source is, or why it wouldn't be displayed. I had a consultant in for the day and we fixed some but couldn't fix all problems with the apps I was trying to get working and trying to debug this we couldn't go through. We added a line to props.conf to ensure Splunk understood the iis log files with the headers and that worked fine. So, searching for sourcetype="iis" gives me all the fields like c_ip c_port cs_host etc but I cannot search for the source above. Where do I start?
Thank you
... View more