All Apps and Add-ons

S.o.S: Topology view continues to list a disabled peer as active search-peer for a given SH

drrushi_splunk
Splunk Employee
Splunk Employee

Why does the Topology view in S.o.S 3.0.1 continue to list a disabled peer as active under the SH detailed information on the right-hand side ?

1 Solution

hexx
Splunk Employee
Splunk Employee

At this time, the scheduled search maintaining the "sos_servers_cache" asset lookup that the Topology view consumes will add any newly-found search peers but will not remove those that no longer respond.

This is a limitation of the current implementation that we plan to improve on in a future release of S.o.S, where we will probably still show the non-responding peers but mark them as such ("missing" or "unresponsive").

In order to get rid of decommissioned search peers, you need to edit the $SPLUNK_HOME/etc/apps/sos/lookups/sos_servers_cache.csv lookup table and manually remove their entries. We also hope to offer a UI-driven method to do this in a future release.

View solution in original post

hexx
Splunk Employee
Splunk Employee

At this time, the scheduled search maintaining the "sos_servers_cache" asset lookup that the Topology view consumes will add any newly-found search peers but will not remove those that no longer respond.

This is a limitation of the current implementation that we plan to improve on in a future release of S.o.S, where we will probably still show the non-responding peers but mark them as such ("missing" or "unresponsive").

In order to get rid of decommissioned search peers, you need to edit the $SPLUNK_HOME/etc/apps/sos/lookups/sos_servers_cache.csv lookup table and manually remove their entries. We also hope to offer a UI-driven method to do this in a future release.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...