No matching index found for arcsight-*

HI mates,
i started arcsight module to pull the data and found the index created in kibana with dashboards but none of the dashboards are accessible.When try to open the dashboard i got the error as: no matching index found :no indices match pattern arcsight-*.

please suggest me how to fix this.

Thanks in advance,
jagan

I also icloud need help with this. Need gimp help ASAP.

Regards,
Shane.

I assume your index is called arcsight-*?

Thanks Lewis,

Yes my index is arcsight-*

Thanks,

jagan

I've had this issue before, not quite sure why. The solution I have always used is to replace it with the index unique ID instead. In Kibana go to Management > Index Pattern and select the arcsight-* index. Then looking in the URL, copy the part AFTER /indices/ and up to the question mark:

image

Go to your visualization and when it appears with the error, go down to the settings and you will see "arcsight-*" mentioned. Replace it with the UUID you just copied. Save and go back into the visualization and it should be working.

HI Lewis,
As stated by you i tried to find the UUID but i did't find any UUID i got only the following url:http://localhost:5601/app/kibana#/management/kibana/indices/arcsight-*?_g=()&_a=(tab:indexedFields) but no UUID .Could you suggest me how to do that.

Thanks,
Jagan

Interesting. If you open up the corresponding visualization, not the dashboard, what do you get?

Hi Lewis ,
i got this (plz see the picture

Regards,
jagan

Do you definitely have data in your index?

No Lewis i don't find any data(document count) when i checked with 'http://localhost:9200/_cat/indices' the indices.
may i know the reason?

Regards,
Jagdish

Have you setup logstash to ingest data?

no ..i did't setup ingest data

If you have no data then there is nothing to visualize :slight_smile:

Thanks Lewis,
ll try to ingest data. if i have any issues i ll be back

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.