2 of 2 people found this helpful
PI Coresight installation includes PI Web API and the Index Search Crawler of PI Web API is used to search for data items. I assume the missing piece for you is the PI Index Search Crawler configuration.
Please browse to the PI Coresight administration page (http://yourCoresighthost/Coresight/Admin). Locate Data Servers Allowed and click [Manage Configuration]. Make sure your PI Data Archive host is listed. If not, please check the Known Servers Table on your PI Coresight host.
I am used to configure the Index Search Crawler trough PI Web API and hence am unsure if it is possible to create an index within the PI Coresight Admin page. The PI Coresight documentation should offer some insights. However, you can browse to https://yourCoresighthost/piwebapi/admin/search/database.html and add an index for your PI Data Archive host there (PI:YourPIDataArchiveHostName). Please note that the Index Search Crawler requires Kerberos authentication.
2 of 2 people found this helpful
Thanks for posting on PI Square. I'm a little confused by what you mean by browsing for tags.
When you are using the search pane, if you need to find tags on a PI Server, you'll have to use the Keyword search to find the tags. The AF Server is different since you can search AND browse for elements and attributes.
In other words, are you having issues searching for tags? For instance, using the search for Sinusoid, does Coresight return results like the one below:
If you are having issues with searching, the very first thing I would check for is if the WebAPI crawler has crawled the PI Server. You can do this by going to:
If the WebAPI properly crawled the PI Server, we should see something like this for the PI Server:
Please let me know what you find out
This might be a authentication over double-hop issue.
Coresight is default installed with Windows authentication (Negotiate), and Coresight requires Windows authentication to your PI Data Archive.
A easy way to find out if it's an authentication issue is to open a display (that contains data) and look at the PI Message Logs on the PI Data Archive when connecting. Typically when it's an authentication issue you'll see that you are attempting to connect with NT AUTHORITY\ANONYMOUS LOGON.
I would check out: Coresight Squared – What’s next? Kerberos and more.. or Live Libarary for infomation on how to configure Kerberos authentication.
Reccomended fix: Configure Kerberos authentication
Work-Arround: Use basic authentication - this solution doesn't scale, when eynought users the local LSAS process will be the bottleneck. Do not use basic authentication if you don't force HTTPS, basic authentication is username and password sent in clear text over the network (Base64 encoded).
Your description of the issue indicates missing Kerberos Delegation.
By adding a client to the scope, data requests are going via multiple hops, from the browser on the client to PI Coresight, to PI Web API, to the PI Data Archive or PI AF Server.
Kerberos is a ticketing system and the multiple hop scenario requires tickets to be forwarded from one instance to another. This forwarding is referred to as Kerberos Delegation and it is by default disabled.
The following KB articles are containing more detailed information.
We are suggesting constrained delegation which more or less means to allow selected services by host or user account (service account) to forward authentication tickets. Not only because configuring Kerberos Delegation requires administrative privileges on the domain controller, we highly recommend to consult with your IT.