The fb_hostname_index_cache is populated from the nightly dbinspect output that is part of the TA. That is, the TA collects information about indexes that have data (on a per host basis), and the app on the SH caches that. If the index doesn't appear in the list, then it doesn't have any data. ... View more

Is there some reason that you could not use the Splunk Python SDK? It handles a lot of that header stuff for you. EDIT: Consider this page for an example of how to connect to Splunk with the Python SDK: http://dev.splunk.com/view/python-sdk/SP-CAAAEE4 Next, this page describes how to run a search: http://dev.splunk.com/view/python-sdk/SP-CAAAEE5 With these, you shouldn't need direct calls to urllib2 methods; the SDK will handle that for you. ... View more

grep "<app" $SPLUNK_HOME/var/run/serverclass.xml | awk -F= '{ print $2 }' | awk '{ print $1 }' ... View more

+1! Don't use a count-based warm bucket sizing rule; there are lots of reasons why hot buckets might roll to warm before they reach their max size. Instead, use @lguinn's suggestion of a size limit on the homePath. Also, please understand that hot buckets aren't magical. There's nothing about a hot bucket that makes it any different to search than a warm bucket--the former is open for writing, that's all. The only difference between warm and cold is the partition on which they're stored (which may lead to different search performance, but in the common case of "just one big partition for all Splunk data", it does not). ... View more