All data is coming to the correct index and sourcetype and no data over the dashboard of "Template for Citrix XenDesktop 7" apps,Any suggestion to overcome this problem.
Take a look over at https://answers.splunk.com/answers/356938/sitename-key-causing-failed-dashboard-searches.html?childT.... If your lookup_host_site.csv has values, and SiteName is what's causing PerfMon data not to show, it could be case-sensitivity.
Good luck!
In the dashboard source query:
Change lookup_sites.csv to lookup_host_site.csv. There is no lookup_sites.csv in the app.
Also, by default the lookup file won't have much data. You have to add to it as per your environment.
My lookup site reads like: | inputlookup lookup_host_site.csv | stats count by SiteName
But I still don't see any data populated to the board.
Basically check your splunk roles for any discrepancies.
All Splunk roles are in place.I am suspecting that there is no data for lookup file which is created default by apps installation.
