- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There appears to be a bug in splunk_monitoring_console\default\checklist.conf.
After running the Health Checks, the GUI drill-down for "Search scheduler skip ratio" states "This checks whether scheduled searches were skipped in the past hour.", but that is not correct. It actually searches all time instead of the last 60 minutes.
I added earliest=-60m to the configuration to resolve it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i need to do this but dont know where to add the line inside checklist.conf, can someone show me an example? do i need to restart the search head after?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just sharing. 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for posting this! I was scratching my head at how I had skipped 71879 searches in an hour!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for reporting this issue with the Monitoring Console Health-check!
Product defect SPL-130183 was filed to fix it in a future release.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is this fixed in 6.5.1?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
According to http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues they are still referring to my work around.
2016-10-12 SPL-130183
Drilldown search for the "Search scheduler skip ratio" Monitoring Console health-check runs against all time instead of last 60 minutes
Workaround:
You can edit this particular check and add "earliest=-60m" as a search term.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How much time it usually take to complete?
For me it took almost more then hour to complete just "search scheduler skip ratio" after implementing your solution.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@saurabh009 What's the size of your environment and what are the specs of the machine running the MC. Is it in distributed mode and is it also on a search head?
The MC just searches the splunk internal logs IIRC, so it taking a long time seems weird unless the machine is either underspec or taxed heavily (like running the MC in distributed mode on an active search head)
Just a couple of thoughts!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, MC is in distributed mode but it is deployed only on dedicated machine not used as search head.
I am trying to monitor more than 100 instances, which comprises of various indexers, search heads,ICMs and DSs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you have a lot of skipped searches returned?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Less than a second is all it took for me.
