Splunk Search
Highlighted

why can't I search metadata via distributed search?

New Member

A question regarding the search in the CLI.

I need to search the metadata via the CLI - it appears I can not

./splunk search "|metadata type=hosts"

So instead I have saved this search as metadataGUI and validated it is available via

./splunk list saved-search

But when I execute
./splunk search “|savedsearch metadataGUI”
or
./splunk search '|savedsearch "metadataGUI"'
or
./splunk search "|savedsearch 'metadataGUI'"

All I get is “Error in 'savedsearch' command: Usage: [options]”

Any ideas?

thanks!

Tags (3)
0 Karma
Highlighted

Re: why can't I search metadata via distributed search?

Splunk Employee
Splunk Employee

These should work. I think that your shell is attempting to interpret the pipe symbol or quotes improperly. What happens if you use single quotes instead of double?

Highlighted

Re: why can't I search metadata via distributed search?

New Member

Hey - I tried all permutations of quotes, both single and double...so I don't think it is that...

thanks though!

0 Karma
Highlighted

Re: why can't I search metadata via distributed search?

Splunk Employee
Splunk Employee

Hi Oliver, so the issue is that metadata does not give any results in distributed search. This was a bug in 4.1.x that was resolved in 4.2.2.

When the indexers DB paths are configured with the "volume" parameter in indexes.conf, metadata search cannot find the DB path. The workaround is to use the absolute path ("homePath" parameter) instead of using the "volume" parameter. You can also upgrade to 4.2.2.

I hope this helps!