Getting Data In

Federated Search - Metrics index, no data found?

Stan816
Explorer

Hello Splunkers!

I am very exited about the new federated search feature starting the Splunk 8.2 version!
I got it to run with a onPrem development machine and a regular index - works as desired and described.

However, if I try the same procedure with a metrics index as a remote data set, my search
either
index=federated:my_metrix_index
or
|mpreview index=federated:my_metrix_index
do not return any result and there is no error returned.

Is this currently the intended behaviour? I would assume, that the REST endpoint is not yet completely adjusted.

Looking forward to hear fro

0 Karma
1 Solution

mljdivemaster
Explorer

Stan816
Explorer

@mljdivemaster  Thanks - Reading the docs properly helps!

Hopefully this will be added in the future.

Best

Stan

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...