Technology Add-on for Fire Brigade version 2: Why won't my fire_brigade searches schedule as expected?

[a212830]

Hi,

I have the Technology Add-on for Fire Brigade version 2 installed via my cluster-manager on my indexers, but the actual scheduled searches are only scheduled on one server. I've tried going into the actual searches and saving them, but they will never show up as scheduled, and as a result, I'm missing data. Any suggestions?

fyi - I tried running the dbinspect search, and I received the following:

Unable to run query ' | `db_inspect_collection($_audit$)`'.

[sloshburch]

Sounds like the macro calls something that is breaking. The job inspector should show the full expanded search which you can throw into a an ad hoc search to debug.

Also, if the message you quoted is coming back, it could be that the $_audit$ token is not getting populated and as such the search is attempting to run without a value for the token. Is it possible this savedsearch is not meant to be scheduled but really only meant to be used in a dashboard form where the token is populated?