Deployment Architecture

index=_interospection

mitali
Explorer

Unable to see my host in index=_interospection /_internal 

after runing the above query in the same host I can't see the hostname.

Unable to see host ES 

mitali_0-1642779910440.png

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mitali,

let me understand:

you runned a search on _internal and in the result list there isn't the hostname of the ES Search Head, is it correct?

Have you this condition also enlarging the time period of your Search?

A very stupid question: did you checked the hostname of your Search Head on the server.conf file ?

Anyway, sometimes _internal logs indexing is delayed when the Indexers are very busy, but you should have many warning messages about this.

For this reason I hint to check the hostname.

Please share more details.

Ciao.

Giuseppe

0 Karma

mitali
Explorer

Yes running index=_internal on ES search head but not showing ES host name 

yes the hostname in server.conf file is correct.

yes even after expanding timerange hostname is not available.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mitali,

did you forwarded the Search Heads logs to the Indexers, as hinted by Splunk best practices?

Ciao.

Giuseppe

0 Karma

mitali
Explorer

Can you Please tell me how to do that?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mitali,

from the Splunk menu on Each Splunk server (except Indexers): [Settings -- Forwarding and Receiving]:

[Forwarding Default -- Save ]

[Configure Forwarding -- New Forwarding host] add indexers

Ciao.

Giuseppe

0 Karma

mitali
Explorer

mitali_0-1642782453954.png

indexers are already aaded

mitali_1-1642782494792.png

this is correct?

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mitali,

Check if there's the port in the destination: "indexer_name:9997".

Then, remember to click "Save" in the "Default configuration", it will ask you a restart.

Then, On your indexers, do you receive also from Forwarders or only by syslog?

Ciao.

Giuseppe

0 Karma

mitali
Explorer

everything is correct just that hostname is not showing up

0 Karma

mitali
Explorer

Error [00000080] Instance name "BCCS-P25ES." REST interface to peer is taking longer than 5 seconds to respond on https. Peer may be over subscribed or misconfigured. Check var/log/splunk/splunkd_access.log on the peer Last Connect Time:2022-01-21T22:45:45.000+05:30; Failed 11 out of 11 times.

 

showing this error in monitoring console.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mitali,

try to use Ip address instead hostname in the "Add indexers" form:

10.10.10.10:9997
10.10.10.11:9997

and then (using telnet) check if the route between SH and IND is open:

telnet <ip_Indexer> 9997

Ciao.

Giuseppe

mitali
Explorer

Problem sloved solution was to create outputs.conf on Search head 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mitali,

really strange: using the GUI as I hinted has the same result!

Anyway, if you solved, please accept the answer for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...