Splunk IT Service Intelligence

ITSI : How to confirm that newly add SHC member is in synch with existing members hosting ITSI?

rbal_splunk
Splunk Employee
Splunk Employee

I have 3 Node Search Head Cluster member with ITSI app. This environment is operational .
Now we added 3 more Search Head Cluster Member.
How can I confirm that newly added SHC member is in synch with others for ITSI app?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Here is After that we confirmed that all the members are in cluster using command

$SPLUNK_HOME/bin/splunk show shcluster-status
$SPLUNK_HOME/bin/splunk show kvstore-status

To confirm if itsi looked good , login to the new SHC member and navigated to ITSI app and in this App under configuration>Services and here count the ## of services ( i.e this should match with old SHC member)

In addition, navigated navigate to Setting>”Search and Report” verify KPI indicators like “>[Indicator - 3e6a914db63fa245b5df5358 - ITSI Search]”

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...