Monitoring Splunk
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- Can you help me figure out why my _audit and _inte...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SoknySplunk
Loves-to-Learn Lots
02-11-2019
05:31 PM
Hello Splunk Community,
Do all you guys know why my _audit and _internal index show status blank on Mater-note?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
adonio
Ultra Champion
02-11-2019
11:58 PM
this is probably because you dont have repFactor set on these indexes ....
when you push configurations, here indexes.conf to your peers, you will have to add that attribute, either for the [default] stanza (so it will apply to all indexes) or under each index stanza [my_index]
my assumption is that you have pushed your index configuration by the Master-Node (e.g. Cluster Master) but the _internal and _audit indexes still use the pre-built per indexer configuration
read here for more detail: https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Indexesconf
look for repFactor
hope it helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
adonio
Ultra Champion
02-11-2019
11:58 PM
this is probably because you dont have repFactor set on these indexes ....
when you push configurations, here indexes.conf to your peers, you will have to add that attribute, either for the [default] stanza (so it will apply to all indexes) or under each index stanza [my_index]
my assumption is that you have pushed your index configuration by the Master-Node (e.g. Cluster Master) but the _internal and _audit indexes still use the pre-built per indexer configuration
read here for more detail: https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Indexesconf
look for repFactor
hope it helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MoniM
Communicator
02-11-2019
09:01 PM
hi @SoknySplunk ,
can you run this btool command, you will get some information about the indexers:-
splunk cmd btool indexes list --debug
Thanks
Get Updates on the Splunk Community!
See your relevant APM services, dashboards, and alerts in one place with the updated ...
As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...
Index This | What goes away as soon as you talk about it?
May 2025 Edition
Hayyy Splunk Education Enthusiasts and the Eternally Curious!
We’re back with this month’s ...
What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025
This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...
