Deployment Architecture

How does DMC determine the status of its search peers?

lycollicott
Motivator

I am seeing a few "Splunk Alert: DMC Alert - Search Peer Not Responding" each day for one of my indexers, but it is always a false alarm. The indexer in question resides at the same site and is in the same subnet as the DMC....there seems to be no network issue.

How does this part of the alert | rest splunk_server=local /services/search/distributed/peers/ work to determine status?

jlaw
Splunk Employee
Splunk Employee

Hm, did you already find this detail in the REST API Reference Manual? It lists the possible values of status.

http://docs.splunk.com/Documentation/Splunk/6.4.2/RESTREF/RESTdeploy#search.2Fdistributed.2Fpeers

0 Karma

lycollicott
Motivator

That's not what I'm looking for, but thanks. I want to know how DMC determines the status of a peer. If I understand how it makes that determination then I can (theoretically) troubleshoot whether or not our false positives are truly false.

0 Karma

mtranchita
Communicator

That DMC alert is making the rest call and alerting if the status is anything other than up. So if the server isn't accessible via the management port or the status is one of the other values in the end point reference it will fire.
Down
Blacklisted
Not a Splunk server
Free Splunk server
Authentication Failed
Duplicate License
Duplicate Servername
Inconsistent bundles

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...