Getting Data In

Deployment Monitor does not show up data

nebel
Communicator

Hi there,

I have two searchheads. One of them is the deployment server.

I moved the Deployment Monitor from the searchhead1 (deployment server) to the second searchhead. Since I moved it to searchhead2 the App doesn't work anymore. In the job list I can see all the jobs, but witout results.
All summary indexes are empty. What is wrong? I just deleted the app from searchhead one and installed it new on searchhead2.

Thanks in advance

Regards

Tags (2)
0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

Which views in particular are you not seeing data in? If it is the throughput and licensing views, I think the issue is that searchhead1 was doing the licensing. By design, a lot of the data required for that part of the app is only available on the licensing instance. You could forward the license_audit and license_usage logs to searchhead2 from searchhead1 or temporarily add searchhead1 as a peer to searchhead2 to see if the data returns.

View solution in original post

0 Karma

araitz
Splunk Employee
Splunk Employee

Which views in particular are you not seeing data in? If it is the throughput and licensing views, I think the issue is that searchhead1 was doing the licensing. By design, a lot of the data required for that part of the app is only available on the licensing instance. You could forward the license_audit and license_usage logs to searchhead2 from searchhead1 or temporarily add searchhead1 as a peer to searchhead2 to see if the data returns.

0 Karma

nebel
Communicator

hi! good news, i have seen that all the searches work fine, i also get results from them. In the jobs monitor i see all the jobs from DM. The one and only thing is, that these results will not written into the summary indexes. Any ideas?

0 Karma

araitz
Splunk Employee
Splunk Employee

It is unclear to me what could be going on. Can you please open a support case? That way, we can get a diag file and investigate further.

0 Karma

nebel
Communicator

hello! no views are working. yesterday i regognized, that outputs.conf the function forwardandindex=disabled. after activating this point, the index summary_sources is getting data and I can use minimal functions in the app. but other views like forwarder connections, license usage still does not work. the indexes summary_indexers, summary_forwarders etc. don't get data...

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...