Getting Data In

Deployment Monitor does not show up data

nebel
Communicator

Hi there,

I have two searchheads. One of them is the deployment server.

I moved the Deployment Monitor from the searchhead1 (deployment server) to the second searchhead. Since I moved it to searchhead2 the App doesn't work anymore. In the job list I can see all the jobs, but witout results.
All summary indexes are empty. What is wrong? I just deleted the app from searchhead one and installed it new on searchhead2.

Thanks in advance

Regards

Tags (2)
0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

Which views in particular are you not seeing data in? If it is the throughput and licensing views, I think the issue is that searchhead1 was doing the licensing. By design, a lot of the data required for that part of the app is only available on the licensing instance. You could forward the license_audit and license_usage logs to searchhead2 from searchhead1 or temporarily add searchhead1 as a peer to searchhead2 to see if the data returns.

View solution in original post

0 Karma

araitz
Splunk Employee
Splunk Employee

Which views in particular are you not seeing data in? If it is the throughput and licensing views, I think the issue is that searchhead1 was doing the licensing. By design, a lot of the data required for that part of the app is only available on the licensing instance. You could forward the license_audit and license_usage logs to searchhead2 from searchhead1 or temporarily add searchhead1 as a peer to searchhead2 to see if the data returns.

0 Karma

nebel
Communicator

hi! good news, i have seen that all the searches work fine, i also get results from them. In the jobs monitor i see all the jobs from DM. The one and only thing is, that these results will not written into the summary indexes. Any ideas?

0 Karma

araitz
Splunk Employee
Splunk Employee

It is unclear to me what could be going on. Can you please open a support case? That way, we can get a diag file and investigate further.

0 Karma

nebel
Communicator

hello! no views are working. yesterday i regognized, that outputs.conf the function forwardandindex=disabled. after activating this point, the index summary_sources is getting data and I can use minimal functions in the app. but other views like forwarder connections, license usage still does not work. the indexes summary_indexers, summary_forwarders etc. don't get data...

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...