topic Re: Spunk search with index not working in Alerting

Why is Spunk search with index not working?

tcsec2user — Tue, 13 Sep 2022 13:39:38 GMT

Spunk search with index not working only "index=_configtracker" index is working

Re: Spunk search with index not working

gcusello — Tue, 13 Sep 2022 11:03:23 GMT

check if your searches are working with other _* indexes (as e.g. _internal.

Then check if you're in violation, in this case only searches on _* indexes are running, the others are blocked, but indexing continues to normally work.

Ciao.

Giuseppe

Re: Spunk search with index not working

tcsec2user — Tue, 13 Sep 2022 11:13:56 GMT

i have tried with same index="_sl1index" and index="_*sl1index" but its not working

Re: Spunk search with index not working

tcsec2user — Tue, 13 Sep 2022 11:17:59 GMT

Re: Spunk search with index not working

tcsec2user — Tue, 13 Sep 2022 11:20:10 GMT

Re: Spunk search with index not working

tcsec2user — Tue, 13 Sep 2022 11:50:53 GMT

How to enable the blocked indexs

Re: Spunk search with index not working

gcusello — Tue, 13 Sep 2022 11:51:19 GMT

Hi @tcsec2user,

are you sure that those indexes are existent and active?

see at [Settings -- Indexes]

Anyway, the index name is strange because _* is a notatiopn for Splunk internal indexes, but I don't know this index that seems to be a custom index.

Ciao.

Giuseppe

Re: Spunk search with index not working

gcusello — Tue, 13 Sep 2022 11:54:55 GMT

hi @tcsec2user,

If there's no Violation, indexes cannot be blocked, only enabled or disabled and you can enable or disable an index in [Settings -- indexes] or in the indexes.conf file.

If you're speaking of blocked indexes for the License Violation, the only way is to ask to Splunk Support an unblock code.

Ciao.

Giuseppe