Getting Data In

Deployment Monitor does not show up data

nebel
Communicator

Hi there,

I have two searchheads. One of them is the deployment server.

I moved the Deployment Monitor from the searchhead1 (deployment server) to the second searchhead. Since I moved it to searchhead2 the App doesn't work anymore. In the job list I can see all the jobs, but witout results.
All summary indexes are empty. What is wrong? I just deleted the app from searchhead one and installed it new on searchhead2.

Thanks in advance

Regards

Tags (2)
0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

Which views in particular are you not seeing data in? If it is the throughput and licensing views, I think the issue is that searchhead1 was doing the licensing. By design, a lot of the data required for that part of the app is only available on the licensing instance. You could forward the license_audit and license_usage logs to searchhead2 from searchhead1 or temporarily add searchhead1 as a peer to searchhead2 to see if the data returns.

View solution in original post

0 Karma

araitz
Splunk Employee
Splunk Employee

Which views in particular are you not seeing data in? If it is the throughput and licensing views, I think the issue is that searchhead1 was doing the licensing. By design, a lot of the data required for that part of the app is only available on the licensing instance. You could forward the license_audit and license_usage logs to searchhead2 from searchhead1 or temporarily add searchhead1 as a peer to searchhead2 to see if the data returns.

0 Karma

nebel
Communicator

hi! good news, i have seen that all the searches work fine, i also get results from them. In the jobs monitor i see all the jobs from DM. The one and only thing is, that these results will not written into the summary indexes. Any ideas?

0 Karma

araitz
Splunk Employee
Splunk Employee

It is unclear to me what could be going on. Can you please open a support case? That way, we can get a diag file and investigate further.

0 Karma

nebel
Communicator

hello! no views are working. yesterday i regognized, that outputs.conf the function forwardandindex=disabled. after activating this point, the index summary_sources is getting data and I can use minimal functions in the app. but other views like forwarder connections, license usage still does not work. the indexes summary_indexers, summary_forwarders etc. don't get data...

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...