In Splunk Enterprise 7.2, Can you help me clear the Splunkd Health Report feature?

[AzJimbo]

I love this feature in 7.2. The icon up front helped me find and fix a serious ingest issue I was otherwise blissfully unaware of. But, I found the only way to clear the health alert (get the icon to change back to green) was to restart splunkd. Did I miss something in the documentation? Is there an easier way to get the menu icon back to green after an issue is fixed?

[bsherwoodofdapt]

I now have this problem too.

The feature alerted me that I was running out of disk space. I solved that problem. But the alert persists, showing the last test was two days ago, when I noticed it and solved it. I now have tens of gigabytes of free space.

So, it looks like when it trips, it stops checking altogether. It should still continue to test and clear the alert when the condition no longer triggers. At a minimum, there should be a button that forces a retest.

This should be a core feature of the platform without forcing you to add in extra applications to manage it.

[MuS]

Hi AzJimbo,

you can hit the /debug/refresh endpoint to do an _reload of the admin/health-report-config endpoint, but be aware that using /debug/refresh on an instance that receives data will result in data loss because it will forcefully restart admin/cooked.

If you want to prevent this from happen, use this app https://splunkbase.splunk.com/app/1871/ which by default excludes this endpoint. It also allows you to reload only one specific endpoint instead of all.

Hope this helps ...

cheers, MuS

[jawaharas]

Thanks. Can't we use below one?

https://<splunk-base-url>/en-GB/debug/refresh?entity=admin/health-report-config

[lakromani]

In my distributed environment, it goes to green by itself. If I do restart some of the indexer, it change yo yellow, then back to green when all are up.