TIBCO LogLogic LMI - Considerations to take into account while configuring a distributed Advance Search

TIBCO LogLogic LMI - Considerations to take into account while configuring a distributed Advance Search

book

Article ID: KB0072035

calendar_today

Updated On:

Products Versions
TIBCO LogLogic Enterprise Virtual Appliance 6.3.0 and higher

Description

When configuring a distributed Advance Search to be run on a Custom Datamodel, users need to make sure that all the information in the filter does not contain specific data (to the node). In other words - for a custom Datamodel to work through a distributed Advance Search the filter of the Datamodel need to be the SAME on all Management Station and Remote Appliances.
 

Issue/Introduction

There are a few things Administrators need to take into account while configuring a distributed Advance Search

Environment

RHEL 7

Resolution

Indeed - a Custom Datamodel configuration may include node related information (such as sys_collectIP, etc) on both Management Station and Remote Appliances. Since the Management Station builds up the query locally - based on the local Custom Datamodel configuration - and it will runs the query (via REST API) on Remote Appliances, users may need to - eventually - remove the node specific information from the Management Station filter (like sys_collectIP) for the query to bring back results from Remote Appliances.

For instance - given a Custom Datamodel named 'MyDatamodel' with filter:

On Management Station
(sys_collectIP='14.14.14.14' ) AND (sys_sourceType ='156' OR sys_sourceType ='1' ) AND (sys_body CONTAINS 'someText' OR sys_body CONTAINS 'more_someText')

On LX_RemoteAppliance1
(sys_collectIP='15.15.15.15' ) AND (sys_sourceType ='156' OR sys_sourceType ='1' ) AND (sys_body CONTAINS 'someText' OR sys_body CONTAINS 'more_someText')

On LX_RemoteAppliance2
(sys_collectIP='16.16.16.16' ) AND (sys_sourceType ='156' OR sys_sourceType ='1' ) AND (sys_body CONTAINS 'someText' OR sys_body CONTAINS 'more_someText')


Bellow queries:

USE MyDatamodel | sys_concentratorId='ALL_LX'| options showAllColumns=true ==> Will not show any result

USE MyDatamodel | sys_concentratorId='ALL'| options showAllColumns=true ==> Will show results for sys_concentratorId='127.0.0.1' only

Removing the sys_collectIP from the Datamodel's filter will make above queries to show results for all appliances.

Additional Information

For further information regarding Distributed Advance Search, please check the online documentation at:
 Online Documentation - TIBCO LogLogic LMI 6.4.0