Splunk IT Service Intelligence

Metrics selection in Splunk app for infrastructure (analysis tab) not working after moving index to S3

Explorer

I am using the Splunk App for infrastructure to collect metrics.
One of my index is called prometheus_dock.
Using SmartStore I recently moved the buckets for that index to S3.
Everything is working fine. I can still query the metrics in search panel (mstats) for that particular index.
However, since the move, when I am trying to explore metrics for entities (tab Analysis, Metrics on the left hand side of the screen) I cannot select metrics as I am getting this error message:

Failed to localize fileTypeSet="{"file_types":["tsidx","deletes"]}" for bid=prometheus_dock~44~91006D1B-62E3-4512-8E14-7120EE9BA8B4

Splunkd.log does not say much either:

MetricStoreCatalogBaseHandler - Failed to localize fileTypeSet="{"file_types":["tsidx","deletes"]}" for bid=prometheus_dock~44~91006D1B-62E3-4512-8E14-7120EE9BA8B4

My guess is that (as oppose as Splunk core), the Splunk app for infrastructure can only get data from local storage and cannot connect to S3...

0 Karma

Splunk Employee
Splunk Employee

The App for Infra team has been unable to reproduce this issue. Did the index name for the metrics change?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!