Monitoring Splunk

Why do some UFs show as missing by Monitoring console & active when viewing the MC ?

SamHTexas
Builder

Why do some UFs show as missing by Monitoring console & active when viewing the MC ? And the number of them keep going up & down ! What needs to checked please?

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I can't explain the conflict of information in the MC.

I can say, however, that you only need one MC in distributed mode.  Choose one to keep and make sure it is peered with all other instances (except forwarders).  Set all the others to standalone mode.  All Splunk instances have the MC built-in and defaulting to standalone mode.  There's no extra load involved for them when the MC is not in use.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Please describe the problem in a little more detail.  "Monitoring Console" and "MC" are the same thing so I would expect the same display.  What exactly are you looking at that is confusing you?  Include screenshots, if possible.

It's often normal for UFs to disappear for a while.  The workstation they're on may reboot, they may reboot themselves when installing an app, network connectivity may fail, etc.

---
If this reply helps you, Karma would be appreciated.
0 Karma

SamHTexas
Builder

Thank u for your message. Looking in monitoring console , running the missing forwarder search under health check. List a few forwarders with status of "missing" but looing to the right under status says "active". One more question please. In the environment I have inherited. There are 2 monitoring consoles in distributed mode with only 1 with peers defined. In addition, on 2 more servers there are monitoring consoles in stand alone & no peers defined. Is this over doing it? Using too much resources for the same purpose? Thank u as always.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I can't explain the conflict of information in the MC.

I can say, however, that you only need one MC in distributed mode.  Choose one to keep and make sure it is peered with all other instances (except forwarders).  Set all the others to standalone mode.  All Splunk instances have the MC built-in and defaulting to standalone mode.  There's no extra load involved for them when the MC is not in use.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...