topic Re: site value not populating correctley in Dashboards & Visualizations

site value not populating correctley

Ram2 — Fri, 31 May 2024 15:33:30 GMT

We have a query where we are getting the count by site.

index=test-index |stats count by host site.

When we run this query in search head cluster we are getting output as

site host

undefined appdtz

undefined appstd

undefined apprtg

undefined appthf

When we run the same query in deployer we are getting output correctly with site.

site host

sitea appdtz

sitea appstd

siteb apprtg

siteb appthf

how to fix this issue in SH cluster.

Re: site value not populating correctley

gcusello — Fri, 31 May 2024 15:43:06 GMT

Hi @Ram2 ,

probaby you runned the search on SHC outside the app where the site fied is extracted.

have you in the events the site field?

Ciao.

Giuseppe

Re: site value not populating correctley

Ram2 — Fri, 31 May 2024 15:56:56 GMT

Hi @gcusello ,

probaby you runned the search on SHC outside the app where the site fied is extracted. --No i am running the same query under search and reporting app in SHC and Deployer

have you in the events the site field? --No these are default values for a host coming from universal forwarder, what they set from application side.