Trend(s) stop gathering data but still run
This is on ESM 69.1 HA.
Since we upgraded it seems that some random trends suddenly stop gathering data, even though they run as scheduled, results are empty even though there is data. Refreshing trend runs still produces no results.
Other trends continue to run fine.
This is a major issue as we have some important bi-weekly reports that rely on the trend. Every time I build a new trend I have to build a new report query for each of dozens of reports pointing a the new trend ( 3 times for one trend so far). This is a pain.
It would be nice if ArcSight gave you an option to retain fields and conditions if you point a query at a new trend instead of deleting existing fields/conditions.
Is anyone else having this problem?
Are you really getting the data from those trend query............ If yes just try to duplicate the trend and make the trend interval as 1 hour to test it, then see if that fixes the issue
Yes, if I build a new trend data is there. I've tried various trend intervals and it still stops. I've done around 5 trends on one query so far and each one eventually stops. Just checked and the trend that ran fine all last week (going back to Apr 9th) stopped gathering data on the 11th of May.
Checking the scheduler and the trends ran every hour but were empty.
Just created an channel with my trend filter and there is lots of data for the 12th to now.