Fire Brigade Not Working

[edwardrose]

Hello All,

I have Fire Brigade TA v2.0.4 installed on all my indexers in my 20 node cluster.  I have the app installed on my DMC host.  I do did the default configuration, which is to allow the saved search to populated the "monitored_indexes.csv" file on all the indexers.  When I bring up the app and start to research the indexes I only see about 20 indexes in the Fire Brigade app.  Splunk monitoring counsole says there are a total of 91 (internal and non-internal).  So the configuration is quite simple:

• TA installed on all indexers in a 20 node cluster
• App installed on DMC

TA is not installed on DMC search head and is not installed on the cluster master.  From what I can tell it should just work.  It has been installed for months and I still can not get it to recognize all the indexes we have in our environment.  Ideas?

thanks

Ed

[codebuilder]

That app is dependent on dbinspect having access to all the indexes.
You need to modify the role assigned to the user(s) that is using the app and add the ability to search all (or some) non-internal indexes.

Go to: Splunk UI > Settings > Roles > your_role_here > Edit > Indexes

From there select the indexes to allow that role to search and click Save.

You may need to log out and back in again but it should work fine after that.

[edwardrose]

I am logged in and running as admin with permissions to all indexes, so I do not think that is the issue.

[codebuilder]

Have you checked permissions on the app itself?

And have you verified the DMC has access to all the indexes you think it should?
With something like:

| tstats count where index=* by index