Monitoring Splunk

Splunk shc member abnormal

meng
New Member
I use metadata to monitor the activity status of member nodes in my cluster, but recently I discovered an exception. My SHC member 01 was found to be inactive, and the last time metadata was sent was a long time ago. However, when I checked my SHC cluster member status in the background, it was always in the up state, and the last time it was sent to the administrator was also recently. I restarted my member 1, but it seems that the latest time of member 1 cannot be seen in the metadata
0 Karma

tej57
Builder

Hey @meng,

You can also check the latest status of your search head cluster using REST endpoint as mentioned here - https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/9.4/cluster-endpo...

It'll always fetch the latest information for your cluster. And as for getting inaccurate information from metadata, as @gcusello mentioned, open up a support case with Splunk.

Thanks,
Tejas.  

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @meng ,

I never experienced this issue, opena a case to Splunk Support, for your case and also for the other Splunk Customer.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...