topic Re: Running a single instance of Splunk, but why does Health Check in the Monitoring Console warn of non-indexer instances that are not sending logs to the indexer? in Getting Data In

Running a single instance of Splunk, but why does Health Check in the Monitoring Console warn of non-indexer instances that are not sending logs to the indexer?

gregbo — Thu, 19 Jan 2017 11:40:50 GMT

I have a single instance Splunk Enterprise setup. When I run the Health Check in the Monitoring Console, it gives me a warning that some of my non-indexer instances are not sending logs to the indexer. Since it's a single instance there are no non-indexer instances. I'm wondering if this check might only apply to multiple-instance environments?

I checked my data inputs and it's monitoring the local logs, so data is coming in to _internal and _introspection

Re: Running a single instance of Splunk, but why does Health Check in the Monitoring Console warn of non-indexer instances that are not sending logs to the indexer?

hunters_splunk — Thu, 19 Jan 2017 15:39:16 GMT

Hi Gregbo,

If your Splunk deployment is single-instance, in Monitoring Console, please click Settings > General Setup from your menu and make sure your Monitoring Console is running inn Standalone, rather than Distributed mode. If the Monitoring Console is running in a mode that does not match your actual topology, you may get inaccurate information from it.

For details, please refer to documentation:
http://docs.splunk.com/Documentation/Splunk/6.5.1/DMC/Configureinstandalonemode
http://docs.splunk.com/Documentation/Splunk/6.5.1/DMC/Singleinstancesetup

Hope this helps. Thanks!
Hunter

Re: Running a single instance of Splunk, but why does Health Check in the Monitoring Console warn of non-indexer instances that are not sending logs to the indexer?

gregbo — Thu, 19 Jan 2017 16:17:33 GMT

It's set to standalone.

Re: Running a single instance of Splunk, but why does Health Check in the Monitoring Console warn of non-indexer instances that are not sending logs to the indexer?

lycollicott — Fri, 20 Jan 2017 15:31:45 GMT

I would try this:

Go to Settings > Distributed Search and make sure that you have no search peers set up at all. (Note that a development license does not include this feature and will mean that there are no search peers configured.)
Go to Monitoring Console > Settings > General Setup where it should look something like this:
Click Apply Changes. You must do this even if you have made no changes on this screen. (It is not very intuitive.)
Try the Health Check again.

Re: Running a single instance of Splunk, but why does Health Check in the Monitoring Console warn of non-indexer instances that are not sending logs to the indexer?

gregbo — Fri, 20 Jan 2017 15:39:41 GMT

i checked and Distributed search is set to No, and there are no peers.
When I went to General Setup, it's set to standalone. the only difference i see is that under Instance (servername) you picture shows "N/A" but on my server the server name is there (same value as under instance (host)

Re: Running a single instance of Splunk, but why does Health Check in the Monitoring Console warn of non-indexer instances that are not sending logs to the indexer?

lycollicott — Fri, 20 Jan 2017 15:43:34 GMT

When you drill down into the "non-indexer instances are not sending logs to the indexer" results what does it say are the instances?

Re: Running a single instance of Splunk, but why does Health Check in the Monitoring Console warn of non-indexer instances that are not sending logs to the indexer?

gregbo — Fri, 20 Jan 2017 16:03:09 GMT

It only lists one instance, itself.

Re: Running a single instance of Splunk, but why does Health Check in the Monitoring Console warn of non-indexer instances that are not sending logs to the indexer?

marina_rovira — Wed, 22 Feb 2017 08:39:28 GMT

Hi all,
I have the same thing and I've already followed all the recomendations here.

Anything else that I cna try?
I would like to have all the checks in green 🙂

Thank you,