All Apps and Add-ons

fire brigade errors

a212830
Champion

Hi,

I have the latest fire brigade installed on a 6.4.1 SHC (and the appropriate TA on the indexers). I'm getting the following errors from "cumulatize usage over all hosts panel" in the the cross-host index overview page.

[subsearch]: Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/data/indexes/dh_clocksync?count=0&search=disabled%3D0 from server=https://127.0.0.1:8089
[subsearch]: Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/services/data/indexes/dh_clocksync?count=0&search=disabled%3D0 from server=https://127.0.0.1:8089 - Not Found

0 Karma

sowings
Splunk Employee
Splunk Employee

I'll put good money on the fact that the "dh_clocksync" index doesn't exist on your search head(s).

0 Karma

sowings
Splunk Employee
Splunk Employee

To elaborate on my answer a bit more: Those pages will attempt a REST query to find out about the configured retention limits for the index. The purpose is to be able to report "% of capacity" as compared to current usage. The SH will attempt to do this across all hosts, including itself. If the index definition for dh_clocksync only exists on the indexers, the SH (127.0.0.1) will report the error you see.

You might consider the Troubleshooting menu, the "Troubleshooting Index Configuration" to see which host(s) don't have that index.

0 Karma

sloshburch
Ultra Champion

What answer/insight are you looking for? I ask because it might be available in the DMC now (and if not, we can let the DMC team know). I have DMC bias...

Psst: I think you mean Fire Brigade, not Fire Bridge.

0 Karma

sowings
Splunk Employee
Splunk Employee

Oh Burch, why no love?!

0 Karma

sloshburch
Ultra Champion

😉 I figured if I was disparaging enough it would be like a Bat-Signal and get you running 😉

0 Karma

a212830
Champion

That's part of what I'm trying to determine - do I need fire brigade.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Family Trees

This puzzle (first published here is based on finding grandparents and grandchildren (inspired by a question ...

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...