topic Re: Splunk shc member abnormal in Monitoring Splunk

Splunk shc member abnormal

meng — Wed, 25 Jun 2025 02:21:58 GMT

I use metadata to monitor the activity status of member nodes in my cluster, but recently I discovered an exception. My SHC member 01 was found to be inactive, and the last time metadata was sent was a long time ago. However, when I checked my SHC cluster member status in the background, it was always in the up state, and the last time it was sent to the administrator was also recently. I restarted my member 1, but it seems that the latest time of member 1 cannot be seen in the metadata

Re: Splunk shc member abnormal

gcusello — Wed, 25 Jun 2025 08:30:07 GMT

Hi @meng ,

I never experienced this issue, opena a case to Splunk Support, for your case and also for the other Splunk Customer.

Ciao.

Giuseppe

Re: Splunk shc member abnormal

tej57 — Wed, 25 Jun 2025 10:06:12 GMT

Hey @meng,

You can also check the latest status of your search head cluster using REST endpoint as mentioned here - https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/9.4/cluster-endpoints/cluster-endpoint-descriptions#get-38

It'll always fetch the latest information for your cluster. And as for getting inaccurate information from metadata, as @gcusello mentioned, open up a support case with Splunk.

Thanks,
Tejas.