All Apps and Add-ons

Dashboards not populating when website monitor on heavy forwarders

Path Finder

It's working fine in an AIO scenario ..

Moved to a cluster and the monitors are running on the Heavy Forwarder and populating my indexes however nothing populating the app on the Search Head Cluster.

All my inputs are on the HF.

I feel I'm missing a silly step - please help!

gratzi.

0 Karma

Builder

Can you validate first if you are able to see the index data on your SH.
if index=YourIndex is not able to populate anything, you might have to start from troubleshooting first your HFs connectivity to the indexers

0 Karma

Path Finder

hi .. yep all expected data is in the right index and searchable from SHC

0 Karma

Builder

Hi Gtazi ,

Did you solve this issue ? I am facing same issue app is on HF and no data in the dashboard?

regards
VG

0 Karma

SplunkTrust
SplunkTrust

What's in props.conf?

If any search time extractions exist in the app, you may have to install it on the search heads too.

0 Karma

Builder

Well yes on SHC I have this app and on HF I configure the input which points to my Indexer . On Both indexer and Searchhead I can see the data in sourcetype="web_ping" . However I am still wondering why SH is not displaying data on the dashboard .

Here is my Default props.conf on both HF and on SH
props.conf
[source::...webavailabilitymodularinput.log]
sourcetype=web
availabilitymodularinput

[source::...websitemonitoringresthandler.log]
sourcetype=website
monitoringresthandler

0 Karma

Builder

Well this is really strange I waited like 40 min and suddenly I started seeing data on the dashboard. This is weird because my interval was 10s . Anyways things are working .