Fire Brigade: How do I troubleshoot Index Configuration panel "Error in 'where' command: The 'mvdedup' function is unsupported or undefined." in Splunk 6.1.3?

[vchepkov]

Get an error on this page:

Number of Indexes with Mis-Matched Size
 Error in 'where' command: The 'mvdedup' function is unsupported or undefined.

I have Splunk 6.1.3

[sowings]

Ah, yes indeed. My mistake, I was searching the wrong code branch! For this particular panel, you can edit the search (until you upgrade Splunk!) to read where mvcount(maxTotalDataSizeMB) > 1. You'll get a false positive if you change the radio button for "Collapse Distinct Values" to "No", but at that point you're looking for other problems.

[sowings]

Sure enough. It looks like the mvdedup function was introduced in 6.2. I've looked over the code (searches) for that dashboard, and I don't find any mvdedup calls, even for a couple back versions of Fire Brigade. What version are you using? If upgrading the app is an option, you may find that it works for you (the current code doesn't contain an mvdedup call).

[vchepkov]

I have the most latest version - 2.0.4 and it's there:

$ grep -R mvdedup .
./default/data/ui/views/index_configs.xml:      where mvcount(mvdedup(maxTotalDataSizeMB)) > 1