Splunk ITSI

Metrics selection in Splunk app for infrastructure (analysis tab) not working after moving index to S3

brunofernandez
Explorer

I am using the Splunk App for infrastructure to collect metrics.
One of my index is called prometheus_dock.
Using SmartStore I recently moved the buckets for that index to S3.
Everything is working fine. I can still query the metrics in search panel (mstats) for that particular index.
However, since the move, when I am trying to explore metrics for entities (tab Analysis, Metrics on the left hand side of the screen) I cannot select metrics as I am getting this error message:

Failed to localize fileTypeSet="{"file_types":["tsidx","deletes"]}" for bid=prometheus_dock~44~91006D1B-62E3-4512-8E14-7120EE9BA8B4

Splunkd.log does not say much either:

MetricStoreCatalogBaseHandler - Failed to localize fileTypeSet="{"file_types":["tsidx","deletes"]}" for bid=prometheus_dock~44~91006D1B-62E3-4512-8E14-7120EE9BA8B4

My guess is that (as oppose as Splunk core), the Splunk app for infrastructure can only get data from local storage and cannot connect to S3...

0 Karma

ntankersley_spl
Splunk Employee
Splunk Employee

The App for Infra team has been unable to reproduce this issue. Did the index name for the metrics change?

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...