Monitoring Splunk

In Splunk Enterprise 7.2, Can you help me clear the Splunkd Health Report feature?

Path Finder

I love this feature in 7.2. The icon up front helped me find and fix a serious ingest issue I was otherwise blissfully unaware of. But, I found the only way to clear the health alert (get the icon to change back to green) was to restart splunkd. Did I miss something in the documentation? Is there an easier way to get the menu icon back to green after an issue is fixed?


I now have this problem too.

The feature alerted me that I was running out of disk space. I solved that problem. But the alert persists, showing the last test was two days ago, when I noticed it and solved it. I now have tens of gigabytes of free space.

So, it looks like when it trips, it stops checking altogether. It should still continue to test and clear the alert when the condition no longer triggers. At a minimum, there should be a button that forces a retest.

This should be a core feature of the platform without forcing you to add in extra applications to manage it.

0 Karma


Hi AzJimbo,

you can hit the /debug/refresh endpoint to do an _reload of the admin/health-report-config endpoint, but be aware that using /debug/refresh on an instance that receives data will result in data loss because it will forcefully restart admin/cooked.

If you want to prevent this from happen, use this app which by default excludes this endpoint. It also allows you to reload only one specific endpoint instead of all.

Hope this helps ...

cheers, MuS

0 Karma

0 Karma


In my distributed environment, it goes to green by itself. If I do restart some of the indexer, it change yo yellow, then back to green when all are up.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...