Monitoring Splunk

When troubleshooting data ingestion on search heads, which SH is best to use ?

damode1
Path Finder

As the title says, when troubleshooting data ingestion on search heads e.g. running an SPL to check if certain data is landing to that index or searching through an addon like aws to check its diagnostic logs on the HF.

For tests like these, which search heads are best to use, monitoring console or a regular search head or an SHC ?

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @damode1,

when you speak of troubleshooting data ingestion, probably you're meaning of serching on Splunk.

In this case you can use every Search Head that can access data, there isn't any prefereable one.

If instead you are using SHs for inputs, it isn't correct, it's always better to have different roles (usually Universal or Heavy Forwarders) to ingest data.

The only exception is Splunk Cloud, where in the Search Heads you can do almost everything.

Ciao.,

Giuseppe

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...