Why are the dashboards not displaying any data in the Enterprise Security app?

[mcxrisley08]

So I recently had to nuke the search head that our Enterprise Security app was running on. I have reinstalled everything and setup search peers but I am having trouble getting any of the dashboards to display any data. Any help with this would be appreciated.

[tiagofbmm]

The data in the ES dashboards is retrieved from the DataModels residing in your indexers.

The first thing to test is if you can search anything from ma data model, like *| from datamodel:. *. Let me know if you have results for any of the datamodels you are using

[mcxrisley08]

I get nothing when running that string in search.

[tiagofbmm]

Are you specifiying one data model?

Like | from datamodel:"Network_Traffic"."All_Traffic"

[alemarzu]

I believe it is like this

| datamodel Authentication search | table Authentication.*

[mcxrisley08]

Ok, That search returns a ton of results. I have made some progress and have got my identities and assets lists created in ES. Some of the issues I'm having now are:

1. The two lists do not share a common value, so I'm not sure how to merge or if they can even merged

2. When I run a search Asset/Identity Investigator, It returns a lot of bogus PII events. I do have the demo data disabled, So I'm not sure why these events are being labeled as such.