LEM - Ghost Nodes.

This is most likely a connector that is seeing a certain field and mapping it to DetectionIP.

Ways to fix:
1. Make sure your connectors are up to date

2. Open a support ticket if your connectors are up to date, so they can help identify the connector that is doing this and helping get you a fix

First off, the numbers look like Unix Epoch Seconds.

Epoch Converter - Unix Timestamp Converter

1491920600000 = Tuesday, April 11, 2017 2:23:20 PM GMT

First problem: it looks like something in the network (assuming this is a recent problem) thinks it's April.

Second problem: somehow, the "Detection Time" field is getting normalized as a "Detection IP."  LEM is seeing these new "IPs" and adding nodes for them

I'm gonna guess there's one of two things happening:

1. You have a syslog device sending data to LEM and that data is getting parsed with the wrong connectors, so LEM thinks an IP is supposed to be where the TIME is showing up.  Updating the connectors and reviewing the connectors you have configured on the LEM appliance would be a good plan of action.  You probably have connectors you don't need running, so that could be part of the issue.
2. You have a rule configured somewhere that has "DetectionTime" in a "DetectionIP" field.  If you go to your Monitor tab and look at the "Rule Activity" filter, what's going on there?  Maybe check recently fired rules and make sure that all the fields match up correctly.

Thanks for help!

• First:
  • Support told me about this it can be a problem of "Random Node Display in LEM" and they give me the URL: Random node displays in LEM - SolarWinds Worldwide, LLC. Help and Support and disable the option of the connector "SecureAuth idP".
  • In the instruction said something check with nDepth the results of particulary the ToolAlias field.
  • In that sample I can see in the ToolAlias a information of the connector "SecureAuth idP Connector Discove".
  • So, in the connector of the appliance, I disabled the second option of "SecureAuth idP Connector Discovery 2".
• Second: It's working, I can delete that nodes and they doesn't appear again.

curtisi​ The connector doesn't work updated, that is true about I don't needed that connector function.