any error or warning in all cluster members need to be monitored and mailed.

Path Finder

We are using Splunk 6.5.6.

Recently we are seeing too many issue on alomst every server.

Is there any way all the server internal logs can be collected at cluster one place( it is costly and time consuming to configure email client on individual cluster member)

from that cluster server we can configure querry like "index=_internal error*" and mail this querry to our entire team. We can find and fix the issue soonest the possible.

Please suggest.

0 Karma


That's what your monitoring console is for:
All Splunk instances send their logs to the indexer cluster, and the MC searches your cluster --> the MC can search logs from all Splunk instances.

If you have no MC set up, set up an MC.

If for some reason you cannot set up an MC, you can schedule alerts from your search head - it too can search the indexer cluster and therefore search all Splunk instances' logs.

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...