All resource graphs empty

[n5zap]

I installed SoS, enabled the collection scripts, and even though the scripts run fine and data is indexed, the resource utilization graphs all say "No results found." I suspect SoS has the wrong hostname in the query. The "instance to query" has the right machine name "voodoo", the data in the index has the name voodoo, the inputs.conf file has the name voodoo, and still there is no data in the graphs. The landing page for the app shows the server's name as "voodoo.viewkeeper.org" and I suspect it is querying under the FQDN instead of the short name, which is wrong. How do I fix the broken query?

[muebel]

In the lower lefthand corner of the chart panel you'll find a magnifier glass icon that will take you to exactly what splunk is searching for in that case. You'll be able to determine if it is using the FQDN there.

If it is, you can look at the dashboard source config to find out why it's using the FQDN. It might be displaying the hostname in the instance dropdown, but that can be different from the token that actually gets passed to the chart search.

These type of issues involve tracing multiple parts of the config, this is just a starting point. Let me know how it goes.