I see.. Well, then that is a RFE: Include a script that runs say every 24h on each host and collects those parameters and use standard log forwarding techniques. None of them is expected to change much anyway, so direct query does not make sense, IMHO. ... View more

I think I am in the same situation (just number of hosts is different). I can see detailed CPU usage for each of the hosts (since _internal is forwarded to the IDX cluster), but I don't see some of the details inside "A glimpse of your Splunk Enterprise instances" panel. I tried to understand how it pulls those, but am giving up 😐 The SH that has the app and all IDX in the cluster show all details, but other SH, LM, DS, HF, etc. show ONLY Version and Platform. I'd like to see $SPLUNK_HOME and number of cores, etc for all instances. Where is this data taken from, is it based on (forwarded) logs? If so can someone show a search with no macros? Or is something pulled via the REST API? Splunk-6.2.2 / S.o.S-3.2.1 here ... View more