topic Re: Web Intelligence application NO data in Distributed environment in All Apps and Add-ons

Web Intelligence application NO data in Distributed environment

paul_1994 — Tue, 25 Sep 2012 22:48:40 GMT

I have installed the app on my search heads and created the indexes on my indexers. I have verified on my indexer from the manger that events are being created and I have searched the indexes on the indexer and search head and returned information, but the app is still empty.

Result of search on the summary indexes If this helps

09/25/2012 15:40:00, search_name="Web Traffic by host fivemin summary - regenerator", search_now=1348613100.000, info_min_time=1348612800.000, info_max_time=1348613100.000, info_search_time=1348613119.944, hits=240, myhost=******, sourcename="V:\\Logfiles\\W3SVC1910282147\\ex120925.log", report="\"WA webtraffic host summary index\""

Any Help would be appreciated..

Re: Web Intelligence application NO data in Distributed environment

araitz — Wed, 26 Sep 2012 05:52:53 GMT

My guess is that your IIS fields are not being extracted properly. When you search your IIS logs using the flashtimeline view, do you see fields like 'cookie', 'referer', 'uri', etc in the field picker? What is the sourcetype that your IIS logs are being assigned?

Re: Web Intelligence application NO data in Distributed environment

paul_1994 — Wed, 26 Sep 2012 16:45:04 GMT

Hey Araitz- I met you @ .conf this year, but any way..

did you want me to do this search in the web app or the search app. I am not sure if it makes a difference.
In the search app i do an search for sourcetype=iis and it returns all the w3c fields and others in the field picker.
The sourcetype being assigned is iis.. and some instances there is iis-2,3... etc but I am fixing those as I run into them

Thanks

Re: Web Intelligence application NO data in Distributed environment

paul_1994 — Fri, 28 Sep 2012 19:11:28 GMT

So I thought I would follow up on my question. I worked with support and found out a couple of things.

you need to make sure your logs are being transformed correctly via props and transform
A lot of the searches depend on the correct Field aliases being defined

For the Field aliases I had to change the defaults to match my environment with custom sourcetypes.

for example here is a default alias for the WI

(?:::){0}iis-* : FIELDALIAS-clientip

I had to clone the one above and create this one

iis : FIELDALIAS-iis-clientip

because my sourcetype for iis was "iis" not "iis-***"