bug - TrackMe Hybrid trackers - In some unexpected circumstances, an Hybrid tracker and its references may be missing from the central collection. While the Hybrid tracker exists, TrackMe's run tracker dropdown will not provide the tracker as executable

trackme-limited / trackme-report-issues

The purpose of this repository is to allow Splunk community to report issues and enhancements requests

2 stars 0 forks source link

bug - TrackMe Hybrid trackers - In some unexpected circumstances, an Hybrid tracker and its references may be missing from the central collection. While the Hybrid tracker exists, TrackMe's run tracker dropdown will not provide the tracker as executable #777

Closed sebwurl closed 6 days ago

sebwurl commented 4 weeks ago

I'm on v2.1.0. When navigation to DSM -> Run Tracker Reports in the Main Dashboard, the dropdown only provides one tracker although two are configured.

guilhemmarchand commented 4 weeks ago

This sounds like an issue in the main collection, the search populating it is driven by:

| inputlookup trackme_virtual_tenants where tenant_id="$tenant_id$" | table tenant_dsm_hybrid_objects | spath input=tenant_dsm_hybrid_objects | rename "reports{}" as reports | fields reports | mvexpand reports | where match(reports, "_tracker_tenant_")

Hybrid trackers themselves are stored in the following KV:

| inputlookup trackme_dsm_hybrid_trackers_tenant_mytenant

I am guessing the main collection lacks the proper hybrid tracker? It could be the case if the trackers have been manipulated (created, cloned, etc) out of TrackMe's control and therefore manually in Splunk Web

sebwurl commented 4 weeks ago

| inputlookup trackme_dsm_hybrid_trackers_tenant_mytenant This lookup includes both trackers.

Them main collection only includes one of it. Trackers were created from scratch in v2.1.0 with the TrackMe Workflow. Not manipulation afterwards.

guilhemmarchand commented 4 weeks ago

Fine thanks @sebwurl I am guessing something went wrong at some points, for some reasons it sounds like the KVrecord was not created / made persistent. (will tripple check!)

Can you please share both contents, either here or by email (nothing in this sensitive) then I will give you clear instructions to fix it.

guilhemmarchand commented 3 weeks ago

bug - TrackMe Hybrid trackers - If some unexpected reasons, an Hybrid tracker and its references are missing from the central collection, while the Hybrid tracker exists, TrackMe's run tracker dropdown will not provide the tracker as executable

To handle this potential issue, while unexpected, a new task named "check_trackers_definition" has been implemented in the Virtual Tenant health tracker.
This task ensures that the central KV collection hybrid field for the component is consistent according to the hybrid tracker KV collection, and will fix the record automatically if necessary

img-000076@2x

sebwurl commented 3 weeks ago

I don’t see any major impact at the moment, so I think I can just wait for the next release that will fix it automatically?

guilhemmarchand commented 3 weeks ago

I don’t see any major impact at the moment, so I think I can just wait for the next release that will fix it automatically?

@sebwurl Yes that is correct, zero impact except not being to manually execute the tracker from the UI ;-)