All Apps and Add-ons

SOS - How Do I Configure for a Distributed Environment?

gbowden_pheaa
Path Finder

I have multiple search heads and multiple indexers in a cluster. I've deployed SOS to the cluster master (also the deployment server and license manager), and to all search heads. I've deployed the TA-SOS to all indexers, enabled scripting on all servers, and restarted the entire environment.

All _internal data is being sent to the cluster.

On my master node, SOS shows only itself and the search peers. This is the same for the rest of the search heads.

I want to be able to see everything from my master node. Am I hoping for too much, or have a missed something in the configurations?

Thanks...

1 Solution

gbowden_pheaa
Path Finder

I've made some headway -

I edited the /$SPLUNK_APP/etc/apps/sos/lookups/splunk_servers_cache.csv file by adding the additional search heads into the list. SOS does not report the server hardware and OS statistics, but I can now see the search statistics from my master node.

That's mostly want I wanted.

View solution in original post

gbowden_pheaa
Path Finder

I've made some headway -

I edited the /$SPLUNK_APP/etc/apps/sos/lookups/splunk_servers_cache.csv file by adding the additional search heads into the list. SOS does not report the server hardware and OS statistics, but I can now see the search statistics from my master node.

That's mostly want I wanted.

hexx
Splunk Employee
Splunk Employee

This is indeed how one should proceed. Instance auto-discovery in S.o.S piggy-backs on distributed search, which is why search-heads cannot discover each other but only their own search peers.

The lack of instance details is expected as well for those instances as again, we rely on distributed search to collect those.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...