Dashboards not populating when website monitor on heavy forwarders

[Skins]

It's working fine in an AIO scenario ..

Moved to a cluster and the monitors are running on the Heavy Forwarder and populating my indexes however nothing populating the app on the Search Head Cluster.

All my inputs are on the HF.

I feel I'm missing a silly step - please help!

gratzi.

[amitm05]

Can you validate first if you are able to see the index data on your SH.
if index=YourIndex is not able to populate anything, you might have to start from troubleshooting first your HFs connectivity to the indexers

[Skins]

hi .. yep all expected data is in the right index and searchable from SHC

[vikas_gopal]

Hi Gtazi ,

Did you solve this issue ? I am facing same issue app is on HF and no data in the dashboard?

regards
VG

[jkat54]

What's in props.conf?

If any search time extractions exist in the app, you may have to install it on the search heads too.

[vikas_gopal]

Well yes on SHC I have this app and on HF I configure the input which points to my Indexer . On Both indexer and Searchhead I can see the data in sourcetype="web_ping" . However I am still wondering why SH is not displaying data on the dashboard .

Here is my Default props.conf on both HF and on SH
props.conf
[source::...web_availability_modular_input.log]
sourcetype=web_availability_modular_input

[source::...website_monitoring_rest_handler.log]
sourcetype=website_monitoring_rest_handler

[vikas_gopal]

Well this is really strange I waited like 40 min and suddenly I started seeing data on the dashboard. This is weird because my interval was 10s . Anyways things are working .