Monitoring Splunk

Why is DMC showing servers "unknown" on overview page?

AzmathShaik
Path Finder

Screenshot 2023-08-11 at 3.46.52 PM.pngHello Splunkers

we recently upgraded our splunk distributed deployment from 8.2.9 to 9.0.5.1. After upgrade our splunk servers are started show under unknown category. 

it's pretty much impacting all the dashboards in monitoring console. below is the error 

"Streamed search execute failed because: Error in 'prerest' command: You do not have a role with the rest_access_server_endpoints capability that is required to run the 'rest' command with the endpoint=/services/server/status/limits/search-concurrency?count=0. Contact your Splunk administrator to request that this capability be added to your role.."

please let me know what can i do to bring the views back to normal. 

 

Thanks in advance

Labels (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

based on that error message you are needing a role which have rest_access_server_endpoints capability. Ask that your splunk admins add role which contains this capability or ad this to your current role.

r. Ismo

0 Karma

AzmathShaik
Path Finder

@isoutamo i have verified the capabilities. i assume this is a capabilities that need to be added to admin role. or do i need to create new role. 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

As admin user should see those dashboards, you could add that capability to admin role.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...