Monitoring Splunk

In Splunk Enterprise 7.2, Can you help me clear the Splunkd Health Report feature?

AzJimbo
Path Finder

I love this feature in 7.2. The icon up front helped me find and fix a serious ingest issue I was otherwise blissfully unaware of. But, I found the only way to clear the health alert (get the icon to change back to green) was to restart splunkd. Did I miss something in the documentation? Is there an easier way to get the menu icon back to green after an issue is fixed?

bsherwoodofdapt
Explorer

I now have this problem too.

The feature alerted me that I was running out of disk space. I solved that problem. But the alert persists, showing the last test was two days ago, when I noticed it and solved it. I now have tens of gigabytes of free space.

So, it looks like when it trips, it stops checking altogether. It should still continue to test and clear the alert when the condition no longer triggers. At a minimum, there should be a button that forces a retest.

This should be a core feature of the platform without forcing you to add in extra applications to manage it.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi AzJimbo,

you can hit the /debug/refresh endpoint to do an _reload of the admin/health-report-config endpoint, but be aware that using /debug/refresh on an instance that receives data will result in data loss because it will forcefully restart admin/cooked.

If you want to prevent this from happen, use this app https://splunkbase.splunk.com/app/1871/ which by default excludes this endpoint. It also allows you to reload only one specific endpoint instead of all.

Hope this helps ...

cheers, MuS

0 Karma

jawaharas
Motivator
0 Karma

lakromani
Builder

In my distributed environment, it goes to green by itself. If I do restart some of the indexer, it change yo yellow, then back to green when all are up.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...