All Apps and Add-ons

Fire Brigade version 2.0.3: How to troubleshoot why indexes are missing from fb_hostname_index_cache?

wsnyder2
Path Finder

When I use Firebrigade, ver 2.0.3, Index Detail, pick a host, the drop down menu under index is not a complete list of all our indexes. In other words the csv file, fb_hostname_index_cache, is incomplete. It is missing some/many of our defined indexes.

Any suggestions for troubleshooting this? I would like to use FB to monitor size of all of our indexes.

ppablo
Retired

FYI, Fire Brigade version 2 will no longer be updated (latest version is 2.0.3). The newer versions 2.0.4 and higher will now be available with the original “Fire Brigade” app on Splunkbase which was just updated to support Splunk 6.3. This is noted on the page for Fire Brigade on Splunkbase:
https://splunkbase.splunk.com/app/1581/

If you have any questions, ping the developer of the app @sowings

Cheers!

0 Karma

sowings_splunk
Splunk Employee
Splunk Employee

The fb_hostname_index_cache is populated from the nightly dbinspect output that is part of the TA. That is, the TA collects information about indexes that have data (on a per host basis), and the app on the SH caches that. If the index doesn't appear in the list, then it doesn't have any data.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...