Hi,
The message suggests that you can connect to your NW device correctly, the app just thinks there's no new data that needs to be read, is this a busy system or a test system with no new data constantly flowing into it?
Also, please check if the last_sid_file (default: /var/tmp/.last_sessionid) exists, if so its contents might be corrupted and the value in there could be larger than the latest session ID on the NetWitness DB.
If that's the case, simply deleting the file should force a restart of data collection based on the latest 5 minutes of events on the NW DB.
Are there any other error messages from when the application first started?
You can also run it from the command line to check for errors using the $SPLUNK_HOME/bin/splunk cmd python $SPLUNK_HOME/etc/apps/netwitness/bin/nwdsdk.py command, if needed but if it's successful the output might be rather large.
Hope that helps! If not please let me know and I'll try to assist further.
Thank you,
Rui
... View more