Have you confirmed in the actual raw event file the the webappid data is present in section H?

Ryan C. Barnett
Director of Application Security Research
Breach Security, Inc.

From: Nicola Bianchi
To: Mod Security
Sent: Fri Dec 18 10:01:54 2009
Subject: [mod-security-users] ModSecurity Console & Group by Application

Hi guys,
we have a problem sorting the alerts on the console by application.

Following the instructions in the user manual and in the new book of Ivan we have done this:

    SecWebAppId MYAPP.COM

On the console when we group by application we only see APP:none.
Any idea?