Splunk Search

How do I debug this Health status error?

Keerthi
Path Finder

Hi, Am new to splunk and will be needing assitance in the health status of splunk.How to debug the below errors in red.

Keerthi_0-1674048253826.png

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Keerthi,

if you click on the red flag, there's a description and a link to documentation to understand the problem.

Anyway, you can see the skipped searches in the monitoring Console, Searches.

The problem usually is one (or both) of these:

  • you have not suffient resources (CPU and RAM, especially CPUs),
  • your storage isn't sufficientely performant (Splunk requires at least 800 IOPS, better 1200).

 About Tailreader, you should understand (using the Monitoring Console Healtcheck) what's the sourcetype and if there's some error in parsing.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...