- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- One random searchhead showing up on the DMC Index ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have one random searchhead that keeps showing up under the "Indexing Performance by Instance" portion of the Indexing Performance dashboard of the DMC. It says it has an inedxing rate of 0 kb/s. It does not show up on any of the other Indexing related dashboards of the DMC and also does not show up under the index clustering displays on the index cluster master. Any ideas as to why this one random search head would be showing up under indexing performance?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
On your DMC go to Settings > Monitoring Console > Settings (in the grey bar) > General Setup
Find the name of the node > click on edit > edit server roles
Remove any roles not related to a search head. I'm guessing it's marked as an "indexer".
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
On your DMC go to Settings > Monitoring Console > Settings (in the grey bar) > General Setup
Find the name of the node > click on edit > edit server roles
Remove any roles not related to a search head. I'm guessing it's marked as an "indexer".
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That was it! Thank you so much
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad to hear that was the resolution and happy to help.
The DMC "role" doesn't actually affect the behavior of the node, only how it's reflected in the reporting.
An upvote would be appreciated and Accept Solution if it helps!
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
