Dashboard is empty but events are being ingested about github_app_for_splunk HOT 11 CLOSED

You can see the required macro changes in the documentation: https://github.com/splunk/github_app_for_splunk#readme

If that doesn't help please comment here!

from github_app_for_splunk.

*There's a bug in GHES 3.6.0 that affects these webhooks, users should upgrade to 3.6.1+ and then Spunk integration will work as expected.

from github_app_for_splunk.

Same problem here, do we need to do some manual changes on the queries?

from github_app_for_splunk.

No, no changes to queries, but did you update the macro to include your indexes?

from github_app_for_splunk.

Hi Doug, I definitely looked in the documentation but it is not specific about which macros to change or how to change them. For example if I see all my github data coming in under the index 'github' how would I then change these macros?

from github_app_for_splunk.

Indeed, noob mistake. You have to search your macros, and edit it with the name of your index (in your case @Jasmine-8i8 github). That makes it work.

from github_app_for_splunk.

Ah ok I didn't realize we must change the index of every macro. Thanks both

from github_app_for_splunk.

I'm getting the same issue, going though the build a few times.. I can manually search the data and it's coming in from GHES, but the dashboard has none of the data. I have verified the macro index as well as the connections, everything looks good and as per documentation.

GHES = 3.6
Splunk Enterprise = 9.0.1
Apps:
Splunk Add-on for Github 2.0.0
GitHub Audit Log Monitoring Add-On for Splunk 1.1.1
GitHub App for Splunk 1.2.3

from github_app_for_splunk.

Just to close out the loop here, @shakerg and I talked offline and got this issue resolved. Seems like there were issues convincing GitHub to send webhooks to his Splunk instance :)

from github_app_for_splunk.

Thanks for the update @leftrightleft ! I'll sync up offline to see if I need to update any documentation to help in the future.

from github_app_for_splunk.

After a rebuild, I'm still running into the same issue where I see data coming in but it's not being represented in the dashboard. @leftrightleft and I are going to have another look later this week, if anything comes out of that which I can provide more details around, happy to share those.

from github_app_for_splunk.