Actually, even if you have Entity Filter field on, that Entity split by field can be just a field in the data. It doesn't look at that field at all in regards to an entity in your entity table. If you can't get entities to filter if you have another field other than host, you need to make sure that the field you are wanting to filter by (example ComputerName) is actually in the data you are getting. Open your KPI in the Service, click the edit button by the KPI, on the Bottom, expand that Generated search and click anywhere in the white space to open that search in a Search window. Run it. If you get no events back (other than something that says N/A), take everything off the search that is appended by the KPI (should start with | `aggregate_raw_). Take all that off and just run the base search. Look at the event fields that come back and verify that the field name you have in that Filter by Entities box, actually exists. 98% of the time the reason that you won't get entities to filter properly is that you are trying to filter by a field that doesn't exist in the data. Also if you are doing that regex in your KPI search, you need to instead do an extraction so that the field exists when the KPI runs. Best practice...don't ever do regex inside of KPIs, do extractions. Hope that helps.
... View more
