Troubleshoot Threat Activity Map

If the Threat Activity Map widget is not showing any data, here are some ways to troubleshoot the problem:

Ensure that GeoLocation data is turned on in your deployment.
Install and properly configure your data indexer(s).
Verify that all Data Indexerservices are running.
Verify that all Web Services are running.
Verify that you have events in your deployment that happened in the last 48 hours and that they contain GeoLocation information.
Check the date range of your Threat Activity Map widget widget to ensure that the range includes ample time for your last piece of data.
Adjust the polling rate to reduce the load on the environment. This adjustment is done in the Configuration tool.

If you still do not have any data, try running a search from the Searches page. For more information on running a search, see Use Search. If your searches are failing and if you have no data in your Threat Activity Map widget, there may be a problem with your Data Indexer configuration.

Try one of the following:

Go to your Data Indexer configuration page and verify that your EMDB Host and Public IPs are set correctly. For more information, see Data Indexer.
In the NGPNode table of your EMDB, verify that the nodes listed are accurate and healthy. Remove rows referring to any nodes not in use. Contact LogRhythm customer support for assistance, if needed.