Getting Data In

Indexer not showing up on _internal or _metric search reports

sonicZ
Contributor

I have 10 indexers and run a bunch of daily reports on heavy volume, hosts and search load.
Recently one of the indexers dropped off all results and i only see 9 out of 10 on all my reports.
What could be causing this, possibly not forwarding _internal indexes, how can i resolve getting the indexer to show up on my reports again?

Tags (2)
0 Karma

sowings
Splunk Employee
Splunk Employee

I'd check the state of the distributed search peers. An indexer will consume its own internal logs ($SPLUNK_HOME/var/log/splunk/*) locally, so if it's not showing up there, I'd guess that it can't be reached at all. Forwarding of the _internal logs shouldn't matter in that case.

Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...