topic Re: Health:Red in Monitoring Splunk

Health:Red

kmill78 — Mon, 20 Jul 2020 01:03:01 GMT

I cannot find what is doing this and the answer that google always brings back from the community is not very good.

Root Cause(s):

The number of extremely lagged searches (1) over the last hour exceeded the red threshold (1) on this Splunk instance

Re: Health:Red

isoutamo — Mon, 20 Jul 2020 04:48:17 GMT

use the MC (monitoring console) to check what is status of scheduled searches. It should show to you which search and why is caused this warning.
r. Ismo

Re: Health:Red

kmill78 — Wed, 22 Jul 2020 00:12:36 GMT

hey thanks ! would you know where exactly in the MC ?

Re: Health:Red

mattymo — Wed, 22 Jul 2020 01:30:44 GMT

depending on your environment, the monitoring console will be available at Settings > Monitoring Console

https://docs.splunk.com/Documentation/Splunk/8.0.5/DMC/DMCoverview

I believe search lag is a symptom of skipped or differed searches...check out the search related stats and review your server resources

Re: Health:Red

kmill78 — Wed, 22 Jul 2020 12:33:43 GMT

thank you very much ! i know how to get in to th MC , its from there i get lost 🙂

Re: Health:Red

mattymo — Wed, 22 Jul 2020 14:13:34 GMT

dont worry ill tie this rope to your waist....dive in, you wont get lost...docs has a guide for how to interpret the data (see link i posted above). Once you have touched the bottom of the pool come back up for some air and let us know what you working with and what you have tried!

Otherwise, check your jobs tab in splunk and look for jobs that are queued or differed. Also it says 1 search, can you not click into it?

Re: Health:Red

isoutamo — Wed, 22 Jul 2020 17:02:52 GMT

I think that correct item is "Scheduler Activity: Instance". If I recall right it is under the Search Head item on distributed environment?