Dashboards & Visualizations

Panel that shows search factor and replication factor status of our Splunk deployment?

Arpit_S
Path Finder

Hi,

Search factor and replication factor are not MET in our splunk deployment. I want to create a dashboard panel to be able to see the Search Factor and Replication Factor. It can also be an alert.

I got the below answer:

https://answers.splunk.com/answers/329356/how-to-create-and-trigger-an-alert-when-replicatio.html

But while running the provided search I am getting below error:

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\"\", \"icon-check\", \"icon-alert\")'.

Is there any way to create a query for this ?

Thanks.

0 Karma
1 Solution

somesoni2
Revered Legend

Do you have Splunk's monitoring console (DMC) enabled in some node? If yes, There are Indexer cluster dashboards available in monitoring console which you can use. You can also take the query from that dashboard and create your alert.

If not, you can use following query to create your panel. Please note this will work on cluster master node. If you want this on your search heads, add your cluster master node as search peer to your search heads.

 | rest  /services/cluster/master/generation/master       
| fields pending_last_reason, search_factor_met, replication_factor_met 
| eval all_data_searchable = if (isnull(pending_last_reason) or pending_last_reason=="", "All Data is Searchable", "Some Data is Not Searchable")
| eval search_factor_met = if (search_factor_met == 1 or search_factor_met == "1", "Search Factor is Met", "Search Factor is Not Met")
| eval replication_factor_met = if (replication_factor_met == 1 or replication_factor_met == "1", "Replication Factor is Met", "Replication Factor is Not Met")"

View solution in original post

somesoni2
Revered Legend

Do you have Splunk's monitoring console (DMC) enabled in some node? If yes, There are Indexer cluster dashboards available in monitoring console which you can use. You can also take the query from that dashboard and create your alert.

If not, you can use following query to create your panel. Please note this will work on cluster master node. If you want this on your search heads, add your cluster master node as search peer to your search heads.

 | rest  /services/cluster/master/generation/master       
| fields pending_last_reason, search_factor_met, replication_factor_met 
| eval all_data_searchable = if (isnull(pending_last_reason) or pending_last_reason=="", "All Data is Searchable", "Some Data is Not Searchable")
| eval search_factor_met = if (search_factor_met == 1 or search_factor_met == "1", "Search Factor is Met", "Search Factor is Not Met")
| eval replication_factor_met = if (replication_factor_met == 1 or replication_factor_met == "1", "Replication Factor is Met", "Replication Factor is Not Met")"

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.