Monitoring Splunk

Health:Red

kmill78
Explorer

I cannot find what is doing this and the answer that google always brings back from the community is not very good. 

Root Cause(s):

  • The number of extremely lagged searches (1) over the last hour exceeded the red threshold (1) on this Splunk instance
Labels (1)
Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

use the MC (monitoring console) to check what is status of scheduled searches. It should show to you which search and why is caused this warning. 
r. Ismo

kmill78
Explorer

hey thanks ! would you know where exactly in the MC ?

0 Karma

mattymo
Splunk Employee
Splunk Employee

depending on your environment, the monitoring console will be available at Settings > Monitoring Console

https://docs.splunk.com/Documentation/Splunk/8.0.5/DMC/DMCoverview

I believe search lag is a symptom of skipped or differed searches...check out the search related stats and review your server resources

 

- MattyMo

kmill78
Explorer

thank you very much ! i know how to get in to th MC , its from there i get lost 🙂 

0 Karma

mattymo
Splunk Employee
Splunk Employee

dont worry ill tie this rope to your waist....dive in, you wont get lost...docs has a guide for how to interpret the data (see link i posted above). Once you have touched the bottom of the pool come back up for some air and let us know what you working with and what you have tried!

 

mattymo_0-1595426983921.png

Otherwise, check your jobs tab in splunk and look for jobs that are queued or differed. Also it says 1 search, can you not click into it?

 

mattymo_0-1595427206401.png

 

- MattyMo

isoutamo
SplunkTrust
SplunkTrust

Hi

I think that correct item is "Scheduler Activity: Instance". If I recall right it is under the Search Head item on distributed environment?

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...