Splunk Health Report warning is not going away

[anel]

Hi all,

5 days ago we got an issue with delayed searches. 

This is fixed and we did not have skipped or delayed searches since. However, the warning is not disappearing. 

Is there a way to manually trigger a recheck, mark this as acknowledged or any other way of making this warning go away? 

[gcusello]

Hi @anel,

tis health check is related to the last 24 hours, are you sure that in this period you don't have delayed searches?

You can check this in the Monitoring Console.

Anyway, it's not possible to reset this alert, you have only to wait for the time.

Ciao.

Giuseppe

[anel]

Hey Guiseppe, 

Thanks for replying. Yeah we did not have delayed searches in the last 24h. 

One day later we still have exactly the same numbers.

[gcusello]

Hi @anel ,

you could go in [Settings > Health Report Manager+ and change the threshold of the latency controls, even if in my mind the issue will disappear in few time.

Ciao.

Giuseppe

[anel]

A restart of the SHC resolved the issue