Panel that shows search factor and replication factor status of our Splunk deployment?

[Arpit_S]

Hi,

Search factor and replication factor are not MET in our splunk deployment. I want to create a dashboard panel to be able to see the Search Factor and Replication Factor. It can also be an alert.

I got the below answer:

https://answers.splunk.com/answers/329356/how-to-create-and-trigger-an-alert-when-replicatio.html

But while running the provided search I am getting below error:

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\"\", \"icon-check\", \"icon-alert\")'.

Is there any way to create a query for this ?

Thanks.

[somesoni2 · Accepted solution]

Do you have Splunk's monitoring console (DMC) enabled in some node? If yes, There are Indexer cluster dashboards available in monitoring console which you can use. You can also take the query from that dashboard and create your alert.

If not, you can use following query to create your panel. Please note this will work on cluster master node. If you want this on your search heads, add your cluster master node as search peer to your search heads.

 | rest  /services/cluster/master/generation/master       
| fields pending_last_reason, search_factor_met, replication_factor_met 
| eval all_data_searchable = if (isnull(pending_last_reason) or pending_last_reason=="", "All Data is Searchable", "Some Data is Not Searchable")
| eval search_factor_met = if (search_factor_met == 1 or search_factor_met == "1", "Search Factor is Met", "Search Factor is Not Met")
| eval replication_factor_met = if (replication_factor_met == 1 or replication_factor_met == "1", "Replication Factor is Met", "Replication Factor is Not Met")"