I'm bemused with Splunk again (otherwise I wouldn't be posting here ;-)).
But seriously - I have an indexer cluster and two separate searchhead clusters connected with that indexer cluster. One shcluster has ES installed, one doesn't.
Everything seems to be working relatively OK.
I have a "temporary" index into which I ingest some events from which I prepare a lookup by means of a report containing some search ending with | outputlookup.
And that also works OK.
Mostly.
Because it used to work on an "old" shcluster (the one with ES). And it still does.
But due to the fact that we have a new shcluster (the one without ES) and of course lookups are not shared between different shclusters, I defined a report on the new cluster as well.
And here's where the fun starts.
The report is defined and works great when run manually. But I cannot schedule it. I open the "Edit Schedule" dialog, i fill in all the necessary fields, I save the settings... and the dialog closes but nothing happens. If I open the "Edit Schedule" dialog again, the report is still not scheduled.
To make things more interesting, I see entries in conf.log but they do show:
payload: { -
children: { -
action.email.show_password: { +
}
dispatch.earliest_time: { +
}
dispatch.latest_time: { +
}
schedule_window: { -
value: 15
}
search: { +
}
}
value:
}
So there are _some_ schedule-related parameters (and yes - if I verify them in etc/users/admin/search/local/savedsearches.conf they are there)
dispatch.earliest_time = -24h@h
dispatch.latest_time = now
schedule_window = 15
But there is no dispatch schedule being applied nor is the schedule enabled at all (the enableSched value is not pushed with the confOp apparently).
So I'm stuck. I can of course manually edit the savedsearches.conf for my user but that's not the point.
The version is 8.2.6.
