Hi!
I’m getting the following errors in results of query:
>index=_internal ExecProcessor error rest.py
06-01-2018 14:56:19.657 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" Exception performing request: HTTPConnectionPool(host='test-host.ru', port=9080): Max retries exceeded with url: /config/healthcheck (Caused by <class 'socket.error'>: [Errno 111] Connection refused)
But when I execute the query:
index="test_2" | spath | timechart span=30s count by body
I have a response which successfully executed without errors. I have to index errors for a future reflection on my dashboard.
In properties set of a rest data input I've checked the checkbox: “Index Error Responses” (Whether or not to index error response codes, defaults to false). No luck
How can I get the errors in my index test_2?
Well, I won't answer this so the app creator can chime in or fix that option, but for now, one thing you could do as a workaround...
index="test_2" OR (index=_internal ExecProcessor error rest.py) ....
That should just make those show up in the search directly.