Alerting

Alert for "Problem replicating config (bundle)"

hartfoml
Motivator

I would like to know when a web:ui user get a bundle replication error. does anyone know where can I look to setup an alert so that I get an email every time this error is shown to the users?

Tags (2)
0 Karma

rtadams89
Contributor

You can find these events in the _internal index.

hartfoml
Motivator

Sorry I am on version 4.3.1 and these logs are not recorded in any index that I can find.

0 Karma

rtadams89
Contributor

Try searching for:

index=_internal component=DistributedPeerManager

This should show you all the bundle replication events. You can further refine this to:

index=_internal component=DistributedPeerManager "replication was unsuccessful"

Which will show you the failures.

0 Karma

hartfoml
Motivator

ya thanks, Thanks was the first place I looked but could not find them in there. Thanks anyway.

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...

From GPU to Application: Monitoring Cisco AI Infrastructure with Splunk Observability ...

AI workloads are different. They demand specialized infrastructure—powerful GPUs, enterprise-grade networking, ...

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...