All Apps and Add-ons

Technology Add-on for Fire Brigade version 2: Why won't my fire_brigade searches schedule as expected?



I have the Technology Add-on for Fire Brigade version 2 installed via my cluster-manager on my indexers, but the actual scheduled searches are only scheduled on one server. I've tried going into the actual searches and saving them, but they will never show up as scheduled, and as a result, I'm missing data. Any suggestions?

fyi - I tried running the dbinspect search, and I received the following:

Unable to run query ' | `db_inspect_collection($_audit$)`'.
0 Karma

Splunk Employee
Splunk Employee

Sounds like the macro calls something that is breaking. The job inspector should show the full expanded search which you can throw into a an ad hoc search to debug.

Also, if the message you quoted is coming back, it could be that the $_audit$ token is not getting populated and as such the search is attempting to run without a value for the token. Is it possible this savedsearch is not meant to be scheduled but really only meant to be used in a dashboard form where the token is populated?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...