This is a poor workaround and results in errors in the btool.log for one.  This needs a better supported solution for checking deployment apps before they are pushed out (or after). /opt/splunk/bin/splunk btool check --dir=/opt/splunk/etc/deployment-apps-symlink --debug | grep Splunk_TA_windows Even with or without the symlink to 'system' under this new deployment-apps-symlink, there are btool errors about spec files either not being present, or being in the incorrect place as per.     ... View more

I came across a similar issue today and was able to fix it. The issue was due to having "$HADOOP_CONF_DIR" as part of my Yarn classpath. In my indexes.conf file, my Yarn classpath was set to this: vix.yarn.application.classpath = $HADOOP_CONF_DIR,/usr/hdp/current/hadoop-client/*,/usr/hdp/current/hadoop-client/lib/*,/usr/hdp/current/hadoop-hdfs-client/*,/usr/hdp/current/hadoop-hdfs-client/lib/*,/usr/hdp/current/hadoop-yarn-client/*,/usr/hdp/current/hadoop-yarn-client/lib/*,/usr/hdp/current/hadoop-mapreduce-client/* Since $HADOOP_CONF_DIR is set to "/etc/hadoop/conf", I updated the Yarn classpath to this: vix.yarn.application.classpath = /etc/hadoop/conf/*,/usr/hdp/current/hadoop-client/*,/usr/hdp/current/hadoop-client/lib/*,/usr/hdp/current/hadoop-hdfs-client/*,/usr/hdp/current/hadoop-hdfs-client/lib/*,/usr/hdp/current/hadoop-yarn-client/*,/usr/hdp/current/hadoop-yarn-client/lib/*,/usr/hdp/current/hadoop-mapreduce-client/* I restarted the search head and ran another query. It completed with no errors. Hope this helps. ... View more

I found this which closely matches your question. | rest /services/messages | table title message severity timeCreated_iso published splunk_server author I then created an alert from this.. ... View more