Skip to main content
josed8
New Member
March 4, 2026
Question

FortiSIEM // Clickhouse Online Data not appear

  • March 4, 2026
  • 1 reply
  • 138 views

Hi guys, 

 

We have FortiSIEM deployment with 1 supervisor and 2 workers, when we deploy our ClickHouse config for event database, we select super and workers as part of keeper cluster, and only workers as part of cluster with query and data checked, as can see in the image below:

 

clickconfig_mar.png

 

 

 

 

when we try to search our data, analytics not show nothing and in our online data (settings -> Database -> Online Data) hot data and warm data are empty as show below: 

 

online_data_click.png

analytics_click.png

 

 

 

 

when we search for our data in os level, we see that it is being written to disk: 

 

/dev/mapper/vg--hot-lv--hot 600G 505G 96G 85% /data-clickhouse-hot-1

 

And in analytics in real-time we can see the logs but not for historical searchs: 

 

historical_search.png

Appreciate if someone can help me to troubleshoot our problem or have any type of solution for us. 

 

Thanks.

1 reply

New Member
May 19, 2026

did u find a solution ?Â