- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Fire Brigade Not Working
![edwardrose edwardrose](https://community.splunk.com/legacyfs/online/avatars/222041.jpg)
Hello All,
I have Fire Brigade TA v2.0.4 installed on all my indexers in my 20 node cluster. I have the app installed on my DMC host. I do did the default configuration, which is to allow the saved search to populated the "monitored_indexes.csv" file on all the indexers. When I bring up the app and start to research the indexes I only see about 20 indexes in the Fire Brigade app. Splunk monitoring counsole says there are a total of 91 (internal and non-internal). So the configuration is quite simple:
- TA installed on all indexers in a 20 node cluster
- App installed on DMC
TA is not installed on DMC search head and is not installed on the cluster master. From what I can tell it should just work. It has been installed for months and I still can not get it to recognize all the indexes we have in our environment. Ideas?
thanks
Ed
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That app is dependent on dbinspect having access to all the indexes.
You need to modify the role assigned to the user(s) that is using the app and add the ability to search all (or some) non-internal indexes.
Go to: Splunk UI > Settings > Roles > your_role_here > Edit > Indexes
From there select the indexes to allow that role to search and click Save.
You may need to log out and back in again but it should work fine after that.
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![edwardrose edwardrose](https://community.splunk.com/legacyfs/online/avatars/222041.jpg)
I am logged in and running as admin with permissions to all indexes, so I do not think that is the issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you checked permissions on the app itself?
And have you verified the DMC has access to all the indexes you think it should?
With something like:
| tstats count where index=* by index
An upvote would be appreciated and Accept Solution if it helps!
![](/skins/images/FE4825B2128CA5F641629E007E333890/responsive_peak/images/icon_anonymous_message.png)