Deployment Architecture

What does Splunk Indexer, Search Head and Forwarder log the first time it connects?

deepak02
Path Finder

Hi,

I have a Splunk (Enterprise) PROD system and I need to figure out the connectivity between the various components.

I have managed to figure out the components - 3 Search Heads + 6 indexers + many forwarders.
(Query used: | rest /services/server/info | dedup splunk_server,server_roles | table splunk_server,server_roles)

I do not have access to the conf files, limited access to REST services, and full access to _internal files.

Can you please tell me how to figure out the connectivity from the internal log files? Do each of the Splunk components log anything each time they connect?

Thanks,
Deepak

Tags (1)
0 Karma

woodcock
Esteemed Legend

Your best best bet is to use the Montoring Console features:

https://docs.splunk.com/Documentation/Splunk/6.5.2/DMC/DMCoverview

This will provide all of the capability and searches that you should need.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi deepak02,
usually it's a Splunk best practice to send all Splunk servers internal logs to indexers so they are searchable (e.g. in the Splunk Monitoring Console you can monitor only Splunk components that send their internal logs to indexers).

In addition in the internal logs there are many useful information for your daily jobs (e.g. control of connected forwarders).

See http://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/WhatSplunklogsaboutitself for all the information you can have from internal logs.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...