Dashboards & Visualizations

Panel that shows search factor and replication factor status of our Splunk deployment?

Arpit_S
Path Finder

Hi,

Search factor and replication factor are not MET in our splunk deployment. I want to create a dashboard panel to be able to see the Search Factor and Replication Factor. It can also be an alert.

I got the below answer:

https://answers.splunk.com/answers/329356/how-to-create-and-trigger-an-alert-when-replicatio.html

But while running the provided search I am getting below error:

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\"\", \"icon-check\", \"icon-alert\")'.

Is there any way to create a query for this ?

Thanks.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Do you have Splunk's monitoring console (DMC) enabled in some node? If yes, There are Indexer cluster dashboards available in monitoring console which you can use. You can also take the query from that dashboard and create your alert.

If not, you can use following query to create your panel. Please note this will work on cluster master node. If you want this on your search heads, add your cluster master node as search peer to your search heads.

 | rest  /services/cluster/master/generation/master       
| fields pending_last_reason, search_factor_met, replication_factor_met 
| eval all_data_searchable = if (isnull(pending_last_reason) or pending_last_reason=="", "All Data is Searchable", "Some Data is Not Searchable")
| eval search_factor_met = if (search_factor_met == 1 or search_factor_met == "1", "Search Factor is Met", "Search Factor is Not Met")
| eval replication_factor_met = if (replication_factor_met == 1 or replication_factor_met == "1", "Replication Factor is Met", "Replication Factor is Not Met")"

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Do you have Splunk's monitoring console (DMC) enabled in some node? If yes, There are Indexer cluster dashboards available in monitoring console which you can use. You can also take the query from that dashboard and create your alert.

If not, you can use following query to create your panel. Please note this will work on cluster master node. If you want this on your search heads, add your cluster master node as search peer to your search heads.

 | rest  /services/cluster/master/generation/master       
| fields pending_last_reason, search_factor_met, replication_factor_met 
| eval all_data_searchable = if (isnull(pending_last_reason) or pending_last_reason=="", "All Data is Searchable", "Some Data is Not Searchable")
| eval search_factor_met = if (search_factor_met == 1 or search_factor_met == "1", "Search Factor is Met", "Search Factor is Not Met")
| eval replication_factor_met = if (replication_factor_met == 1 or replication_factor_met == "1", "Replication Factor is Met", "Replication Factor is Not Met")"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...