What are the steps to perform as sanity checks after Splunk Indexer restart?

[isoutamo · Accepted solution]

In distributed environment you should have MC (monitoring console) set up. Then you can use it to see that everything is ok, it also give you a warning when any peer is down or there are any issues (previously defined in MC).
r. Ismo

[VatsalJagani]

I would run some searches from the search head to make sure indexers are returning results.

Like -> index=* | dedup sourcetype, splunk_server | table sourcetype, splunk_server

Make sure the splunk_server field mentions all the indexers that you have.

Also, run search -> index=_internal -> in all-time real-time and check for the splunk_server field to make sure that all the indexers are ingesting the new data coming to Splunk as expected.