Deployment Architecture

index=_interospection

mitali
Explorer

Unable to see my host in index=_interospection /_internal 

after runing the above query in the same host I can't see the hostname.

Unable to see host ES 

mitali_0-1642779910440.png

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mitali,

let me understand:

you runned a search on _internal and in the result list there isn't the hostname of the ES Search Head, is it correct?

Have you this condition also enlarging the time period of your Search?

A very stupid question: did you checked the hostname of your Search Head on the server.conf file ?

Anyway, sometimes _internal logs indexing is delayed when the Indexers are very busy, but you should have many warning messages about this.

For this reason I hint to check the hostname.

Please share more details.

Ciao.

Giuseppe

0 Karma

mitali
Explorer

Yes running index=_internal on ES search head but not showing ES host name 

yes the hostname in server.conf file is correct.

yes even after expanding timerange hostname is not available.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mitali,

did you forwarded the Search Heads logs to the Indexers, as hinted by Splunk best practices?

Ciao.

Giuseppe

0 Karma

mitali
Explorer

Can you Please tell me how to do that?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mitali,

from the Splunk menu on Each Splunk server (except Indexers): [Settings -- Forwarding and Receiving]:

[Forwarding Default -- Save ]

[Configure Forwarding -- New Forwarding host] add indexers

Ciao.

Giuseppe

0 Karma

mitali
Explorer

mitali_0-1642782453954.png

indexers are already aaded

mitali_1-1642782494792.png

this is correct?

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mitali,

Check if there's the port in the destination: "indexer_name:9997".

Then, remember to click "Save" in the "Default configuration", it will ask you a restart.

Then, On your indexers, do you receive also from Forwarders or only by syslog?

Ciao.

Giuseppe

0 Karma

mitali
Explorer

everything is correct just that hostname is not showing up

0 Karma

mitali
Explorer

Error [00000080] Instance name "BCCS-P25ES." REST interface to peer is taking longer than 5 seconds to respond on https. Peer may be over subscribed or misconfigured. Check var/log/splunk/splunkd_access.log on the peer Last Connect Time:2022-01-21T22:45:45.000+05:30; Failed 11 out of 11 times.

 

showing this error in monitoring console.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mitali,

try to use Ip address instead hostname in the "Add indexers" form:

10.10.10.10:9997
10.10.10.11:9997

and then (using telnet) check if the route between SH and IND is open:

telnet <ip_Indexer> 9997

Ciao.

Giuseppe

mitali
Explorer

Problem sloved solution was to create outputs.conf on Search head 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mitali,

really strange: using the GUI as I hinted has the same result!

Anyway, if you solved, please accept the answer for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...