topic Introspection logs in Dashboards & Visualizations

Introspection logs

bosseres — Thu, 11 Nov 2021 12:43:58 GMT

Hello everyone,

I found due DMC console, that splunk stopped get logs into _introspection index.

I open search like this "index=_introspection sourcetype=splunk_resource_usage component=PerProcess host=*" and see that there were events, but they stopped.

Can anybody help me with this problem?

Re: Introspection logs

bosseres — Thu, 11 Nov 2021 13:44:40 GMT

the host is up

Re: Introspection logs

richgalloway — Thu, 11 Nov 2021 14:08:10 GMT

There should be a message in splunkd.log explaining the problem.

index=_internal source=*splunkd.log

Check that there is enough storage on the volume containing the introspection index.

Also, confirm no one turned off introspection. See https://docs.splunk.com/Documentation/Splunk/8.2.2/Troubleshooting/ConfigurePIF#Disable_logging