- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- Splunk monitoring console unable to gather Resourc...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have a problem with my distributed environment where some of my instances appear greyed out under CPU and memory utilization. If I open the specific instance panels I see the red icon with the errors below.
This is very strange because it affects the indexers only. The only difference with them is that the web service is disabled a per Splunk best practices.
I tried with splunk support by opening a case but we couldn't find the solution yet.
Splunk Version: 8.0.3 (indexers), 8.0.5 (everything else)--- Is this a problem?
[subsearch][servername]Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/server/info?count=0&strict=false from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API.
[subsearch][servername]Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/services/server/info?count=0&strict=false from server=https://127.0.0.1:8089 - Bad Request
--- MORE INFO ---
If I run the command manually like:
https://10.10.10.1:8089/services/server/status/resource-usage/hostwide
I get the output in my browser.
I read this post: https://community.splunk.com/t5/Getting-Data-In/Splunk-Management-Console-Error-subsearch-Rest-Proce...
It talks about the indexer role, my Cluster Master is also "SHC Deployer" (Search Head Cluster Deployer), would this be the role I have to move? Its not an Indexer, I have 6 dedicated indexers and 5 dedicated search heads.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The problem seems to be with the versions compatibility.
A bit absurd that a new MC version is not retro-compatible, not even a mayor upgrade 8.0.3 vs 8.0.5.1.
If anyone gets this problem, its because the new version sends "strict=false" and the old version does not like it. You cant even set the MC to not send this option.... quite disappointing.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The problem seems to be with the versions compatibility.
A bit absurd that a new MC version is not retro-compatible, not even a mayor upgrade 8.0.3 vs 8.0.5.1.
If anyone gets this problem, its because the new version sends "strict=false" and the old version does not like it. You cant even set the MC to not send this option.... quite disappointing.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
