All Apps and Add-ons
Highlighted

dashboards not populated when new index defined

Builder

I have created a new index (newrelic) and added the account input settings - the newrelic index is populated with my application
(just the one currently) however the application dashboard does not work.

If i then use the 'main' index as per the setup screenshots - the dashboards work with the same data thats alos populating the new_relic index

how to populate the dashboards using the new_relic index created.

Have checked permissions etc, new index is in context of new relic TA, the new_relic index correctly uses the newrelic:applications sourcetype.

The macro 'getsources' runs ok but only uses the 'main' index

thx

Re: dashboards not populated when new index defined

Esteemed Legend

I believe you are supposed to modify the getsources macro and change main to new_relic and then everything should work.

View solution in original post

Highlighted

Re: dashboards not populated when new index defined

Builder

Thanks mate - that was it.

The 'main' index wasn't specified in the macro so thats what was throwing me - so i guess it just default there.

So i changed the 'get_sources(4)' macro from:

(sourcetype=$newsourcetype$ source=$newsource$) OR (sourcetype=newrelicaccount source="$oldsource$" accountid=$accountid$ ) | eval newsource = if(sourcetype="newrelicaccount",inputname +":" + accountid,source), accountid = if(sourcetype="newrelicaccount",accountid, rtrim(newsource,":") )

to

index=new_relic (sourcetype=$newsourcetype$ source=$newsource$) OR (sourcetype=newrelicaccount source="$oldsource$" accountid=$accountid$ ) | eval newsource = if(sourcetype="newrelicaccount",inputname +":" + accountid,source), accountid = if(sourcetype="newrelicaccount",accountid, rtrim(newsource,":") )

All good.

0 Karma
Highlighted

Re: dashboards not populated when new index defined

Engager

Thanks all, It worked for me also, Big thanks to both.

0 Karma