topic Re: Component Code List and Definitions in Monitoring Splunk

Component Code List and Definitions

verizonrap2017 — Tue, 07 May 2024 13:32:27 GMT

Does anyone know of a list of component codes and their meanings for at least _internal and _audit? I have asked instructors and Splunk direct with no help so far.

Re: Component Code List and Definitions

kiran_panchavat — Tue, 07 May 2024 16:25:47 GMT

@verizonrap2017

I'm not sure what you're looking for; are you looking for Splunk components or the default indexes in Splunk? Please use the links provided below for reference.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/Aboutmanagingindexes

https://docs.splunk.com/Documentation/Splunk/9.2.1/Capacity/ComponentsofaSplunkEnterprisedeployment

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

Re: Component Code List and Definitions

verizonrap2017 — Mon, 13 May 2024 14:04:48 GMT

Thank you Kiran. What I am looking for is the meaning of each component code found. For instance If I run -

index=_* | stats count by component index log_level

I see many component codes with Warning or Error. The question becomes what does that component code mean and if there is a warning or error what is the action needed to correct or tune? I do not see any documentation in Splunk to that effect and have asked Splunk PS, Splunk Instructors and Splunk Support. No answer yet.

I want to build dashboards and associated alerts to help me know the stability and status of the platform.

Thank you!