All Apps and Add-ons

Technology Add-on for Fire Brigade version 2: Why won't my fire_brigade searches schedule as expected?

a212830
Champion

Hi,

I have the Technology Add-on for Fire Brigade version 2 installed via my cluster-manager on my indexers, but the actual scheduled searches are only scheduled on one server. I've tried going into the actual searches and saving them, but they will never show up as scheduled, and as a result, I'm missing data. Any suggestions?

fyi - I tried running the dbinspect search, and I received the following:

Unable to run query ' | `db_inspect_collection($_audit$)`'.
0 Karma

sloshburch
Splunk Employee
Splunk Employee

Sounds like the macro calls something that is breaking. The job inspector should show the full expanded search which you can throw into a an ad hoc search to debug.

Also, if the message you quoted is coming back, it could be that the $_audit$ token is not getting populated and as such the search is attempting to run without a value for the token. Is it possible this savedsearch is not meant to be scheduled but really only meant to be used in a dashboard form where the token is populated?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...