I cannot figure out why this isn't reporting correctly. We are running Splunk Enterprise 7.1.4. I have updated my Chargeback app to 2.2.1. I have also rerun the initial search which builds the customers.csv file (on a side note, thanks for automating the micro_lic_GB calculation) . The "Indexes Accounted For" report still shows the same indexes in both columns. This is my search:
| set diff [| inputlookup customers.csv | dedup idx | fields idx | search NOT idx=*summary* | rename idx AS "Index defined in customers.csv, but is NOT defined in Splunk"] [| rest /services/data/indexes | search isInternal=0 | search NOT title=*summary* | dedup title | fields title | rename title AS "Index is NOT defined in customers.csv"]
Thanks for the help in advance.
... View more