All Apps and Add-ons

Splunk App for Infrastructure entity inactive after 3 minutes of collecting data

hgu
Explorer

Currently, I have a search head running Splunk Enterprise 7.2 on Windows Server machine and an indexer running Splunk Enterprise 7.2 on another Windows Server machine. I have installed Splunk App for Infrastructure (1.2.0) on the search head and have installed Splunk Add-on for Infrastructure (1.2.0) + Splunk Universal Forwarder (7.1.1) on the indexer.

I set up Splunk App for Infrastructure and added the indexer as an entity. I was able to observe about 3 minutes of the indexer's status/performance before data stopped being collected. Now in the Entities view, the indexer is marked as "Inactive". Also, in the Analysis tab for the indexer, I'm getting a lot of errors saying "Unknown search command 'mcatalog'."

I have no idea why the indexer is inactive. Splunkd and the SplunkUniversalForwarder services are running on the indexer. Any ideas on what might be wrong would be really appreciated!

0 Karma
1 Solution

hgu
Explorer

I made a dumb mistake. The powershell script that I'm supposed to run when I add an entity was pointed to the search head instead of the indexer. I must've had it correct at one point for 3 minutes before rerunning the incorrect one, causing the 3 minutes of misleading success.

View solution in original post

0 Karma

hgu
Explorer

I made a dumb mistake. The powershell script that I'm supposed to run when I add an entity was pointed to the search head instead of the indexer. I must've had it correct at one point for 3 minutes before rerunning the incorrect one, causing the 3 minutes of misleading success.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...