That search returns the data that I'm expecting, and are tagged as you say.
I get: dispatched search for savedsearch_id="nobody;Splunk_SA_CIM;_ACCELERATE_DM_Splunk_SA_CIM_Web_ACCELERATE_"
searching for index=_audit "search_id='SummaryDirector*" "user=splunk-system-user" "*web*" `
I only see "Setup" when I choose one of my three search heads. When I use the VIP address, the "Setup" command isn't listed. Also, when I enter Setup, the index I keep my logs for the web events isn't available. I think that's the problem.
I'm running a search head cluster w/ 3 search heads, and 2 standalone indexers. Why doesn't the Splunk SA Cim APP see the necessary index, when I can search it using the splunk search bar?
... View more