Hello,Recently, I've enabled the meta key 'action' on the archiver so
that I can use it to filter the results in the Investigate window, I've
done that by modifying the file 'index-archiver-custom.xml', adding a
new key for it.I've applied the new ch...
Hello, I'm keep getting this alert at a high rate 'Correlation Server in
Unhealthy State' coming from the ESA host, it's cleared automatically in
(5 - 10) minutes.There is no issue with the available resources. What
exactly does this statistic (Proce...
Hello,In our virtual deployment we have enabled cold storage of the
archiver, when browsing the files stored in the cold storage path, I
don't see any compressed files, all of them are binary files. Is this
the normal behavior? how can I check if the...
Hello,I'm getting multiple frequent alerts indicating that some services
gets unhealthy state on the admin server, this includes (content server,
config server, reporting engine, investigate server, ..etc.), and it
gets clear after a few minutes (les...
Hello,I'm using New Health & Wellness, I have generated multiple reports
but I'm not able to download any one, pdf or pngI've tried multiple
simple reports but same behavior, when clicking on download button I get
the following message, which seems t...
The problem is solved now, I had to enable indexing of all default meta
keys (43) after that I was able to see the data in both Investigate page
and in the reports.Thank you so much for your help and for the advices
to use reporting engine.
I tried multiple where conditions but with no result, simply used 'did
exist' in the where clause which refers to the decoder ID and no result
as well.I applied that same rules on different data source such as the
concentrator and it worked fine.
Hi @JohnKisner The meta key that I enabled are "Action Event, Event
Description", I will share the custom index file directly with you.I
updated the custom index file using the UI (Services -> Archiver ->
config -> Files)Whatever rule I use, there ar...
Hi @JohnKisner ,I tried to generate some reports using the reporting
engine, but unfortunately I got the same issue, there is no available
data: So, I believe that the problem is basically with the Archiver
service. Here are the actions I did so far:...
Thanks for the valuable information.My point is that I want to
investigate and apply some filters on old events that are only available
using the Archiver, for example, 3 months back which is not available on
the Concentrator. Is there any other way ...
