Highlighted
Super Contributor.. Super Contributor..
Super Contributor..
479 views

Trend(s) stop gathering data but still run

This is on ESM 69.1 HA.

Since we upgraded it seems that some random trends suddenly stop gathering data, even though they run as scheduled, results are empty even though there is data. Refreshing trend runs still produces no results.

Other trends continue to run fine.

This is a major issue as we have some important bi-weekly reports that rely on the trend. Every time I build a new trend I have to build a new report query for each of dozens of reports pointing a the new trend ( 3 times for one trend so far). This is a pain.

It would be nice if ArcSight gave you an option to retain fields and conditions if you point a query at a new trend instead of deleting existing fields/conditions.

Is anyone else having this problem?

Labels (1)
0 Likes
3 Replies
Highlighted
Honored Contributor.
Honored Contributor.

Are you really getting the data from those trend query............ If yes just try to duplicate the trend and make the trend interval as 1 hour to test it, then see if that fixes the issue

Raj
0 Likes
Highlighted
Super Contributor.. Super Contributor..
Super Contributor..

Yes, if I build a new trend data is there. I've tried various trend intervals and it still stops. I've done around 5 trends on one query so far and each one eventually stops. Just checked and the trend that ran fine all last week (going back to Apr 9th) stopped gathering data on the 11th of May.
Checking the scheduler and the trends ran every hour but were empty.

Just created an channel with my trend filter and there is lots of data for the 12th to now.

0 Likes
Highlighted

Hi.. I am facing similar issue where the trend runs successfully but pulls no logs. Please let me know if you were able to find solution for the issue?
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.