Monitoring Splunk

Why do some UFs show as missing by Monitoring console & active when viewing the MC ?

SamHTexas
Contributor

Why do some UFs show as missing by Monitoring console & active when viewing the MC ? And the number of them keep going up & down ! What needs to checked please?

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I can't explain the conflict of information in the MC.

I can say, however, that you only need one MC in distributed mode.  Choose one to keep and make sure it is peered with all other instances (except forwarders).  Set all the others to standalone mode.  All Splunk instances have the MC built-in and defaulting to standalone mode.  There's no extra load involved for them when the MC is not in use.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Please describe the problem in a little more detail.  "Monitoring Console" and "MC" are the same thing so I would expect the same display.  What exactly are you looking at that is confusing you?  Include screenshots, if possible.

It's often normal for UFs to disappear for a while.  The workstation they're on may reboot, they may reboot themselves when installing an app, network connectivity may fail, etc.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

SamHTexas
Contributor

Thank u for your message. Looking in monitoring console , running the missing forwarder search under health check. List a few forwarders with status of "missing" but looing to the right under status says "active". One more question please. In the environment I have inherited. There are 2 monitoring consoles in distributed mode with only 1 with peers defined. In addition, on 2 more servers there are monitoring consoles in stand alone & no peers defined. Is this over doing it? Using too much resources for the same purpose? Thank u as always.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I can't explain the conflict of information in the MC.

I can say, however, that you only need one MC in distributed mode.  Choose one to keep and make sure it is peered with all other instances (except forwarders).  Set all the others to standalone mode.  All Splunk instances have the MC built-in and defaulting to standalone mode.  There's no extra load involved for them when the MC is not in use.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!