topic Splunk Rest Commands Invalid in Monitoring Splunk

Splunk Rest Commands Invalid

andrew_burnett — Fri, 11 Aug 2023 15:39:19 GMT

I have a HF that was recently expanded in terms of its RAM capacity. Ever since, there has been an issue with REST commands off specific endpoint.

Example:

| rest splunk_server=splunk-hf1 /services/server/info (Works great and gives me the expected results)

| rest splunk_server_group=dmc_group_* /services/server/status/resource-usage/hostwide (When I run it it acts like some of my servers, including a HF has 0 memory)

Re: Splunk Rest Commands Invalid

andrew_burnett — Fri, 11 Aug 2023 15:52:50 GMT

It makes no difference if I change it and run it on the HF locally itself, the second REST command never works.

Re: Splunk Rest Commands Invalid

isoutamo — Fri, 11 Aug 2023 16:13:09 GMT

What I have realised with REST api, it could give you a wrong answers if there has happened something "weird" after splunkd has restarted and even sometime if host hasn't rebooted e.g. after volumes/LUNs have added.

So have you try to restart splunkd on those host which you have wrong information? Also do same if you have added mem to host as live operation.

I also suggest you to "disable boot-start" and reenable it after memory changes.

In my test env these seems to work correctly (removed some unneeded lines from output)

[splunk@splunk-demo-rh8] ~> (0) $ splunk search '| rest splunk_server_group=* /services/server/status/resource-usage/hostwide' -output json|jq|egrep mem "mem": "15725.703", [splunk@splunk-demo-rh8] ~> (0) $ splunk search '| rest splunk_server=local /services/server/info' -output json|jq|egrep -i mem "physicalMemoryMB": "15725", [splunk@splunk-demo-rh8] ~> (0) $

Splunk 9.0.5

r. Ismo