Getting Data In

Using a REST command to query the status of the splunkweb process?

Lucas_K
Motivator

I'd like to be able to check on the status of the splunkweb process from distributed splunk instances within a splunk search. I could easily do this with a script but I want to avoid at all costs. I need an internal splunk method to obtain the status of remote splunk installations.

At the moment I can simply query splunkd processes using a rest command such as "| rest /services/server/info" and I can be sure that the splunkd process on all the listed hosts is working as they are returning info about themselves.

I have had situations in the past where splunkweb or splunkd would independently crash so i'd like to make a dashboard + alerts that would inform us of this (without use of scripts!!!!)

Tags (2)
0 Karma

kevin5even
Explorer

You can get the process IDs of the running splunkweb processes in your distributed environment using the following:

| rest /services/server/status/resource-usage/splunk-processes | search process=splunkweb | table splunk_server pid

You can adapt this to get a count and alert off that...

kevin5even
Explorer

This was from a 6.1.1 instance. According to the docs, that rest API endpoint was not added until version 6.1.

0 Karma

Lucas_K
Motivator

Thanks for the reply i'd been waiting aaages to try and find something like this but it doesn't seem to work on my installs. What version of splunk was that run on?

edit: If I walk the path I can see

| rest /services/server/status/resource-usage

Inside there I get hostwide and splunk-processes but they both don't contain anything.

0 Karma

GauravSplunxter
Explorer

same issue here. looking into the permissions/roles to resolve the issue.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...