The following meta keys have no values

[RomanZeltser]

Maybe a dumb question but what does it mean when I get the following message in Investigation > Navigate and, basically, empty page above the message? Is it a normal response when I have no data or something is misconfigured?

The following meta keys have no values

service, orig_ip, ip.src, ip.dst, tcp.dstport, ip.dstport, alias.host, country.src, country.dst, org.src, subject, org.dst, email.src, email.dst, email, domain.dst, client, content, server, attachment, action, filetype, extension, filename, username, user.dst, user.src, error, crypto, ssl.subject, ssl.ca, risk.info, risk.suspicious, risk.warning, threat.category, threat.desc, threat.source, alert, did, sourcefile

[ArthurCostigan1]

Roman:

It is normal to see a message like this at the bottom of your Navigation pane.  This means that based on the query you have run or the time-frame chosen, there is no meta values for these specific keys.  

What would be indicative of a misconfiguration OR an event source issue would be to see this message for meta keys were you are expecting values.  

If you are seeing no meta keys at all in an investigation, the quickest way to check if Netwitness is collecting and aggregating data is to open an Investigation using the default meta keys ( In the Meta menu, select Use Default Meta Keys) and selecting a Time Range of "Add Data"  from the drop down.  If you don't see anything in the Investigation pane, you should check the configuration of your decoders, concentrators and brokers.  The visualization pane can provide a visual reference as well.

Check out this article for more about default meta keys and how to view and manage them  Investigation: Manage and Apply Default Meta Keys in an Investigation 

Hope this helps.

Art

[RomanZeltser]

Thank you for a detailed answer. I have some investigations with data but sometimes I have empty pages.