All Apps and Add-ons

Fire Brigade version 2.0.3: How to troubleshoot why indexes are missing from fb_hostname_index_cache?

Path Finder

When I use Firebrigade, ver 2.0.3, Index Detail, pick a host, the drop down menu under index is not a complete list of all our indexes. In other words the csv file, fb_hostname_index_cache, is incomplete. It is missing some/many of our defined indexes.

Any suggestions for troubleshooting this? I would like to use FB to monitor size of all of our indexes.


FYI, Fire Brigade version 2 will no longer be updated (latest version is 2.0.3). The newer versions 2.0.4 and higher will now be available with the original “Fire Brigade” app on Splunkbase which was just updated to support Splunk 6.3. This is noted on the page for Fire Brigade on Splunkbase:

If you have any questions, ping the developer of the app @sowings


0 Karma

Splunk Employee
Splunk Employee

The fb_hostname_index_cache is populated from the nightly dbinspect output that is part of the TA. That is, the TA collects information about indexes that have data (on a per host basis), and the app on the SH caches that. If the index doesn't appear in the list, then it doesn't have any data.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...