How to handle too many sources in data inputs - Support and Troubleshooting

How to handle too many sources in data inputs These instructions will help you to resolve the issue of too many log sources in Health Log Analytics. You will delete Log Sources, ElasticSearch indexes, and metadata.

Required Roles: evt_mgmt_admin doc_store_admin

Overview: Identify which sources are erroneous and what Data Input Mapping is creating them. Fix the Data Input Mapping script Stop the relevant Data Input(s) Delete the Source(s) (Optional) Delete the Source Type (Optional) Delete Source examples Restart Occultus Start the Data Input(s) Instructions: Identify and stop root cause Identify which sources are erroneous and what Data Input Mapping is creating them. It may be useful to check: Data Input screen Data Input Mapping screen Log Sources screen Fix the Data Input Mapping script Health Log Analytics -> Mapping -> Data Input Mapping Check the values of 'applicationService' and ‘component' to make sure they are calculated correctly. If ‘component’ is set to null, ensure that ‘sourceType’ is calculated correctly. Check any RegEx is formed correctly Check anywhere that the contents of the log are dynamically used to define applicationService, component, or SourceType Test your script with multiple log samples You can choose a different log sample by clicking the Magnifying glass on the right end of “Raw input samples”. You can paste a custom sample in the “Test a manual sample” text box Delete erroneous records Stop the relevant Data Input(s) Health Log Analytics -> Data Inputs If stopping a single Data Input, open the record and click Stop Data Input If stopping multiple Data Inputs, select each of them using the check box on its left. Then select the drop-down box at the bottom of the list and choose Stop Data Input . Delete the Source(s) Health Log Analytics -> Log Sources (table : sn_occ_sources) Filter this table to ONLY show records you wish to DELETE Delete each record you wish to delete If deleting one-by-one, open the record to delete then press the Delete button If deleting in bulk, select the checkboxes for the records to delete (or select all by clicking the bottom checkbox). Click the drop-down menu Actions on selected rows... and choose Delete If the delete button does not appear, make sure you are in the Global scope (Optional) Delete the Source Type *This step is only needed if the extra sources were created due to erroneous Source Types also being created Filter this table to show ONLY the records you wish to DELETE Deleting these records will delete the corresponding Source Type Structure, so check that you will not lose any important Source Type Structures before deleting the Source Type. Delete each record you wish to delete If deleting one-by-one, open the record to delete then press the Delete button If deleting in bulk, select the checkboxes for the records to delete (or select all by clicking the bottom checkbox). Click the drop-down menu Actions on selected rows... and choose Delete If the delete button does not appear, make sure you are in the Global scope (Optional) D elete Source example System Definition -> Scripts – Background var table = "sn_occ_source_example"; var gr = new GlideRecord(table); gr.addNullQuery("source"); gr.deleteMultiple(); gs.info(gr.getRowCount());

Restart Occultus and Data Input Restart Occultus Restart using a system property: Health Log Analytics -> Health Log Analytics Administration -> System Properties . Search for management.restart_flag and set the value to t rue Alternately, a Support Consultant can manually restart If restart must be avoided, you can skip restarting occultus if future sources will NEVER be created with the same Application and Component combination as those you deleted. Restart is recommended for best reliability. Start the Data Input(s) If you see an error message "You need to save changes before you can start the data input. Click update to save." you may need to click Update , then Start Data Input . If you see the error again, right click on the header and click Save , then Start Data Input . (This is a known bug that will be fixed in a future release)