topic Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events in Deployment Architecture

Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

israelgutierrez — Wed, 30 Mar 2016 21:58:01 GMT

We have weird behavior, in the Data Summary Screen on the Search Head, we see a Host reporting events, when clic on the host searching for the details, the Search Head shows 0 results

This is happening only with 1 host, other hosts from the same index and same sourcetype didn't present the same issue.

Any Ideas?

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

martin_mueller — Wed, 30 Mar 2016 22:05:42 GMT

Have there been calls to the delete command?

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

israelgutierrez — Wed, 30 Mar 2016 22:09:22 GMT

No, no one have those privileges

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

martin_mueller — Wed, 30 Mar 2016 22:11:07 GMT

Okay... made sure the search runs over a sufficiently large time range?

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

israelgutierrez — Wed, 30 Mar 2016 22:17:43 GMT

The Summary screen shows Last Update 3-30-16 2:34:26.000 PM

But searching for that Host on Today, shows 0 results

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

martin_mueller — Wed, 30 Mar 2016 22:19:03 GMT

Search over all time - could be old data / misrecognized timestamp.

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

martin_mueller — Wed, 30 Mar 2016 22:25:18 GMT

Yeah, last log received - as in time it was indexed. The timestamp extracted from the events may be different.

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

israelgutierrez — Wed, 30 Mar 2016 22:46:15 GMT

Ok, for that Got It, after a couple of reviews we are seeing that the _time of the log and the _indexed time are consistent so we are extracting the time correctly

But Sadly we know that host it have events today, and in the "All time search" the logs for today doesn't shows, but the Data Summary it shows updates

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

martin_mueller — Wed, 30 Mar 2016 22:47:33 GMT

Hmm... to drill deeper, run this over today:

| tstats count where index=* by index host sourcetype

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

israelgutierrez — Wed, 30 Mar 2016 22:59:00 GMT

Doing that search the host we are looking for didn't appear

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

martin_mueller — Wed, 30 Mar 2016 23:04:29 GMT

Okay, this?

| metadata type=hosts index=*

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

israelgutierrez — Wed, 30 Mar 2016 23:11:57 GMT

Yes, on that one the host appears with 766 Events

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

martin_mueller — Wed, 30 Mar 2016 23:25:56 GMT

There should be three timestamps for that host, what are they?

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

israelgutierrez — Wed, 30 Mar 2016 23:43:32 GMT

FirstTime
30/3/2013 14:06:56 GMT-6:00

LastTime
30/3/2013 17:08:12 GMT-6:00

RecentTime
30/3/2016 17:08:27 GMT-6:00

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

martin_mueller — Wed, 30 Mar 2016 23:45:56 GMT

All your data is from 2013, so searching today won't find it.

The metadata command powering the data summary is a bit more lenient with time ranges so it finds those old events.

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

israelgutierrez — Thu, 31 Mar 2016 00:13:07 GMT

Thanks, The type of log is different from the others and the time it was bad recognized

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

lib_systems — Thu, 21 Apr 2016 01:56:49 GMT

I am experiencing the same issue as the original post, however, I have been issuing the delete command to remove test data, etc. When I issue the delete command it confirms that the correct number of events have been deleted, yet days later the Data Summary still shows event counts for hosts which no longer have associated events indexed. Please advise.

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

martin_mueller — Thu, 21 Apr 2016 08:53:56 GMT

The data summary is not updated by the delete command.

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

lib_systems — Thu, 21 Apr 2016 12:31:50 GMT

And so how does one update the Data Summary after using the delete command? The documentation glosses over this point.

Re: Data Summary Report Events for a Host but searching the Host in the Shearch Head Doesn't Show Events

martin_mueller — Thu, 21 Apr 2016 12:34:20 GMT

You don't. It updates itself when the bucket ages out.