topic Splunk Cloud Health Checks / Monitoring in Monitoring Splunk

Splunk Cloud Health Checks / Monitoring

sting663 — Thu, 21 Jan 2021 10:19:38 GMT

Hello there,

I know its possible to set up monitoring / health checks on Splunk Enterprise, but is this a function that can be set up for Splunk Cloud? if so what would the process(s) be as all i can find is referrence to Splunk Enterprise.

Many Thanks.

Sting 663

Re: Splunk Cloud Health Checks / Monitoring

richgalloway — Thu, 21 Jan 2021 14:42:28 GMT

Splunk monitors your cloud instances for you. You can do some of your own monitoring using the Cloud Monitoring Console app.

What, specifically, do you want to monitor/check?

Re: Splunk Cloud Health Checks / Monitoring

sting663 — Thu, 21 Jan 2021 14:58:56 GMT

Thanks Rich,

We had a challenge where we had a Heavy Forwarder down for x amount of days not forwarding logs but there no indication from our cloud service of this so looking at safeguards on how this can be prevented the next time around.

Cheers,

Sting 663

Re: Splunk Cloud Health Checks / Monitoring

richgalloway — Thu, 21 Jan 2021 16:05:55 GMT

The CMC app can monitor forwarders similarly to how the MC does so in on-prem instances.

You also can do it yourself, by monitoring the number of messages in index=_internal from each forwarder (assuming they're forwarding their own logs).

Re: Splunk Cloud Health Checks / Monitoring

sting663 — Mon, 25 Jan 2021 08:32:37 GMT

CMC is enabled but monitors throughput and indexing performance – this is not for system availability.

Re: Splunk Cloud Health Checks / Monitoring

richgalloway — Mon, 25 Jan 2021 13:54:18 GMT

Go to the Forwarders:Deployment dashboard in the CMC to see the status of your forwarders.