Am I missing something?
I have vscode running splunk extension and created a simple _default.spl2nb.
I'm able to testing it and getting results back, and uploading to the search app or a custom app spl2-test also gives me success message.
But when I go to the splunk deployment <app>/default/data. I don't see spl2 folder at all.
What's going on? Thanks.
I don't know why I have to run the following, and the spl2 file shows up.
~/splunk/bin/splunk download-spl2-modules app spl2-test -dest default
But still, I am getting error when I try to run
|@spl2 from search1
Error in 'SearchParser': The SPL2 query is invalid: 'unknown error: Unable to fetch roles for the user'.
I will answer my own question:
* spl2 currently still uses kv-store and file sync implementation is neither complete nor fully functional as of today.
* one needs to apply enterprise license for spl2 to be enabled.