Monitoring Splunk

Splunk Rest Commands Invalid

andrew_burnett
Path Finder

I have a HF that was recently expanded in terms of its RAM capacity. Ever since, there has been an issue with REST commands off specific endpoint.

Example:

| rest splunk_server=splunk-hf1 /services/server/info (Works great and gives me the expected results)

| rest splunk_server_group=dmc_group_* /services/server/status/resource-usage/hostwide (When I run it it acts like some of my servers, including a HF has 0 memory)

Labels (1)
0 Karma

andrew_burnett
Path Finder

It makes no difference if I change it and run it on the HF locally itself, the second REST command never works.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

What I have realised with REST api, it could give you a wrong answers if there has happened something "weird" after splunkd has restarted and even sometime if host hasn't rebooted e.g. after volumes/LUNs have added.

So have you try to restart splunkd on those host which you have wrong information? Also do same if you have added mem to host as live operation.

I also suggest you to "disable boot-start" and reenable it after memory changes.

In my test env these seems to work correctly (removed some unneeded lines from output)

[splunk@splunk-demo-rh8] ~>
(0) $ splunk search '| rest splunk_server_group=* /services/server/status/resource-usage/hostwide' -output json|jq|egrep mem
    "mem": "15725.703",
[splunk@splunk-demo-rh8] ~>
(0) $ splunk search '| rest splunk_server=local /services/server/info' -output json|jq|egrep -i mem
    "physicalMemoryMB": "15725",
[splunk@splunk-demo-rh8] ~>
(0) $

Splunk 9.0.5 

 r. Ismo

0 Karma
Get Updates on the Splunk Community!

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...