Hi,
Newbie here. We recently had professional services setup and installed Splunk a few months back. It's been running fine until recently.
On our Splunk Enterprise Security server, we have the following messages:
3/27/2018, 10:29:55 AM
Search peer splunkentsec01 has the following message: Health Check: msg="A script is in an unknown state" input="../bin/collector.path" stanza="default" Learn more.
3/27/2018, 10:29:55 AM
Search peer splunkentsec01 has the following message: Health Check: msg="A script is in an unknown state" input="./opt/splunk/etc/apps/SA-Utils/bin/configuration_check.py" stanza="configuration_check://confcheck_es_migrate_reviewstatus_transitions
It is then followed by messages stating that our three Indexers do not meet minimum system requirements which I do not believe is the case.
Search peer splunkentsec01 has the following message: Health Check: The list of indexes to be searched by default by the admin role on Splunk server "splunkentsec01" includes all non-internal indexes which might cause performance problems. Learn more.
3/27/2018, 10:29:55 AM
Search peer splunkentsec01 has the following message: Health Check: Splunk server "splunkindexer03" does not meet the recommended minimum system requirements. Learn more.
3/27/2018, 10:29:55 AM
Search peer splunkentsec01 has the following message: Health Check: Splunk server "splunkentsec01" does not meet the recommended minimum system requirements. Learn more.
3/27/2018, 10:29:55 AM
Search peer splunkentsec01 has the following message: Health Check: Splunk server "splunkindexer01" does not meet the recommended minimum system requirements. Learn more.
3/27/2018, 10:29:55 AM
Search peer splunkentsec01 has the following message: Health Check: Splunk server "splunkindexer02" does not meet the recommended minimum system requirements. Learn more.
The "learn more" links did lead me to a KB article. But it seems more to do with suppressing the messages than actually determining the root cause and fixing the problem.
Any guidance and help would be appreciated.
Thanks in advance.
... View more