How do I debug this Health status error?

[Keerthi]

Hi, Am new to splunk and will be needing assitance in the health status of splunk.How to debug the below errors in red.

Keerthi_0-1674048253826.png

[gcusello]

Hi @Keerthi,

if you click on the red flag, there's a description and a link to documentation to understand the problem.

Anyway, you can see the skipped searches in the monitoring Console, Searches.

The problem usually is one (or both) of these:

• you have not suffient resources (CPU and RAM, especially CPUs),
• your storage isn't sufficientely performant (Splunk requires at least 800 IOPS, better 1200).

 About Tailreader, you should understand (using the Monitoring Console Healtcheck) what's the sourcetype and if there's some error in parsing.

Ciao.

Giuseppe