Indeed - a Custom Datamodel configuration may include node related information (such as sys_collectIP, etc) on both Management Station and Remote Appliances. Since the Management Station builds up the query locally - based on the local Custom Datamodel configuration - and it will runs the query (via REST API) on Remote Appliances, users may need to - eventually - remove the node specific information from the Management Station filter (like sys_collectIP) for the query to bring back results from Remote Appliances.For instance - given a Custom Datamodel named 'MyDatamodel' with filter:
On Management Station
(sys_collectIP='14.14.14.14' ) AND (sys_sourceType ='156' OR sys_sourceType ='1' ) AND (sys_body CONTAINS 'someText' OR sys_body CONTAINS 'more_someText')
On LX_RemoteAppliance1
(sys_collectIP='15.15.15.15' ) AND (sys_sourceType ='156' OR sys_sourceType ='1' ) AND (sys_body CONTAINS 'someText' OR sys_body CONTAINS 'more_someText')
On LX_RemoteAppliance2
(sys_collectIP='16.16.16.16' ) AND (sys_sourceType ='156' OR sys_sourceType ='1' ) AND (sys_body CONTAINS 'someText' OR sys_body CONTAINS 'more_someText')
Bellow queries:
USE MyDatamodel | sys_concentratorId='ALL_LX'| options showAllColumns=true ==> Will not show any result
USE MyDatamodel | sys_concentratorId='ALL'| options showAllColumns=true ==> Will show results for sys_concentratorId='127.0.0.1' only
Removing the sys_collectIP from the Datamodel's filter will make above queries to show results for all appliances.