I have added a few Ubuntu Linux server. They are forwarding log data no problem, and I can search it. Problem is that they do not show up as "Hosts" so I can modify queries based on that. How do I tag them as Hosts?
You shouldn't have to tag your data as Hosts. It is just based on the "host" field that the data is indexed with. When you search for your data, what "host" is set for it?
If you do a search like:
| metadata type=hosts | search host=<host of your data>
What is returned? This is essentially the search used to populate the dashboard.
You shouldn't have to tag your data as Hosts. It is just based on the "host" field that the data is indexed with. When you search for your data, what "host" is set for it?
If you do a search like:
| metadata type=hosts | search host=<host of your data>
What is returned? This is essentially the search used to populate the dashboard.
It just took a while for the dashboard to populate I guess. I think I was referring to the *NIX app at that time. It still does not show the "Hosts". I have opened another post that is more specific to the problem.