Getting Data In

Deployment Monitor does not show up data

nebel
Communicator

Hi there,

I have two searchheads. One of them is the deployment server.

I moved the Deployment Monitor from the searchhead1 (deployment server) to the second searchhead. Since I moved it to searchhead2 the App doesn't work anymore. In the job list I can see all the jobs, but witout results.
All summary indexes are empty. What is wrong? I just deleted the app from searchhead one and installed it new on searchhead2.

Thanks in advance

Regards

Tags (2)
0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

Which views in particular are you not seeing data in? If it is the throughput and licensing views, I think the issue is that searchhead1 was doing the licensing. By design, a lot of the data required for that part of the app is only available on the licensing instance. You could forward the license_audit and license_usage logs to searchhead2 from searchhead1 or temporarily add searchhead1 as a peer to searchhead2 to see if the data returns.

View solution in original post

0 Karma

araitz
Splunk Employee
Splunk Employee

Which views in particular are you not seeing data in? If it is the throughput and licensing views, I think the issue is that searchhead1 was doing the licensing. By design, a lot of the data required for that part of the app is only available on the licensing instance. You could forward the license_audit and license_usage logs to searchhead2 from searchhead1 or temporarily add searchhead1 as a peer to searchhead2 to see if the data returns.

0 Karma

nebel
Communicator

hi! good news, i have seen that all the searches work fine, i also get results from them. In the jobs monitor i see all the jobs from DM. The one and only thing is, that these results will not written into the summary indexes. Any ideas?

0 Karma

araitz
Splunk Employee
Splunk Employee

It is unclear to me what could be going on. Can you please open a support case? That way, we can get a diag file and investigate further.

0 Karma

nebel
Communicator

hello! no views are working. yesterday i regognized, that outputs.conf the function forwardandindex=disabled. after activating this point, the index summary_sources is getting data and I can use minimal functions in the app. but other views like forwarder connections, license usage still does not work. the indexes summary_indexers, summary_forwarders etc. don't get data...

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...