Dashboards & Visualizations

Panel that shows search factor and replication factor status of our Splunk deployment?

Arpit_S
Path Finder

Hi,

Search factor and replication factor are not MET in our splunk deployment. I want to create a dashboard panel to be able to see the Search Factor and Replication Factor. It can also be an alert.

I got the below answer:

https://answers.splunk.com/answers/329356/how-to-create-and-trigger-an-alert-when-replicatio.html

But while running the provided search I am getting below error:

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\"\", \"icon-check\", \"icon-alert\")'.

Is there any way to create a query for this ?

Thanks.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Do you have Splunk's monitoring console (DMC) enabled in some node? If yes, There are Indexer cluster dashboards available in monitoring console which you can use. You can also take the query from that dashboard and create your alert.

If not, you can use following query to create your panel. Please note this will work on cluster master node. If you want this on your search heads, add your cluster master node as search peer to your search heads.

 | rest  /services/cluster/master/generation/master       
| fields pending_last_reason, search_factor_met, replication_factor_met 
| eval all_data_searchable = if (isnull(pending_last_reason) or pending_last_reason=="", "All Data is Searchable", "Some Data is Not Searchable")
| eval search_factor_met = if (search_factor_met == 1 or search_factor_met == "1", "Search Factor is Met", "Search Factor is Not Met")
| eval replication_factor_met = if (replication_factor_met == 1 or replication_factor_met == "1", "Replication Factor is Met", "Replication Factor is Not Met")"

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Do you have Splunk's monitoring console (DMC) enabled in some node? If yes, There are Indexer cluster dashboards available in monitoring console which you can use. You can also take the query from that dashboard and create your alert.

If not, you can use following query to create your panel. Please note this will work on cluster master node. If you want this on your search heads, add your cluster master node as search peer to your search heads.

 | rest  /services/cluster/master/generation/master       
| fields pending_last_reason, search_factor_met, replication_factor_met 
| eval all_data_searchable = if (isnull(pending_last_reason) or pending_last_reason=="", "All Data is Searchable", "Some Data is Not Searchable")
| eval search_factor_met = if (search_factor_met == 1 or search_factor_met == "1", "Search Factor is Met", "Search Factor is Not Met")
| eval replication_factor_met = if (replication_factor_met == 1 or replication_factor_met == "1", "Replication Factor is Met", "Replication Factor is Not Met")"
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...