All Apps and Add-ons

Fire Brigade Install on Distributed Environment

emiller42
Motivator

Hello!

I'm slightly confused about the installation procedure for Fire Brigade when using a distributed environment. (Separate Search Heads and Indexers) According to the doc and this answer, the TA goes on indexers, and the App goes on search heads. However, the App expects monitored_indexes.csv to exist, which is populated by a saved search that only exists in the TA. (So the csv file will be on the indexers, but not on the search heads)

Installing both the App and the TA to the search heads resolves this, but that doesn't match the documentation. Am I missing something?

For reference, this is what the search log reports when attempting to access the csv:

05-07-2015 10:08:41.441 WARN  ApplicationManager - Cannot import non-existent application: TA-fire_brigade
05-07-2015 10:08:41.449 WARN  SearchOperator:inputcsv - sid:1431011321.4138.search_head The lookup table 'monitored_indexes.csv' is invalid.
Tags (1)
1 Solution

sowings
Splunk Employee
Splunk Employee

You're correct; the app tries to find the monitored index list, to display "how many are we keeping an eye on?". This would work just fine for a single instance install, but since version 6.0, the dbinspect search command is distributed, which means that if you install the TA on the SH as well, you'll double-measure your indexers.

A few folks have wondered about this, and since it's not truly relevant on the search head in a distributed environment, the next release won't include that panel.

View solution in original post

ppablo
Retired

FYI, Fire Brigade version 2 will no longer be updated (latest version is 2.0.3). The newer versions 2.0.4 and higher will now be available with the original “Fire Brigade” app on Splunkbase which was just updated to support Splunk 6.3. This is noted on the page for Fire Brigade on Splunkbase:
https://splunkbase.splunk.com/app/1581/

If you have any questions, ping the developer of the app @sowings

Cheers!

0 Karma

sowings
Splunk Employee
Splunk Employee

You're correct; the app tries to find the monitored index list, to display "how many are we keeping an eye on?". This would work just fine for a single instance install, but since version 6.0, the dbinspect search command is distributed, which means that if you install the TA on the SH as well, you'll double-measure your indexers.

A few folks have wondered about this, and since it's not truly relevant on the search head in a distributed environment, the next release won't include that panel.

emiller42
Motivator

Thank you for the clarification!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...