Monitoring Splunk

In Splunk Enterprise 7.2, Can you help me clear the Splunkd Health Report feature?

AzJimbo
Path Finder

I love this feature in 7.2. The icon up front helped me find and fix a serious ingest issue I was otherwise blissfully unaware of. But, I found the only way to clear the health alert (get the icon to change back to green) was to restart splunkd. Did I miss something in the documentation? Is there an easier way to get the menu icon back to green after an issue is fixed?

bsherwoodofdapt
Explorer

I now have this problem too.

The feature alerted me that I was running out of disk space. I solved that problem. But the alert persists, showing the last test was two days ago, when I noticed it and solved it. I now have tens of gigabytes of free space.

So, it looks like when it trips, it stops checking altogether. It should still continue to test and clear the alert when the condition no longer triggers. At a minimum, there should be a button that forces a retest.

This should be a core feature of the platform without forcing you to add in extra applications to manage it.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi AzJimbo,

you can hit the /debug/refresh endpoint to do an _reload of the admin/health-report-config endpoint, but be aware that using /debug/refresh on an instance that receives data will result in data loss because it will forcefully restart admin/cooked.

If you want to prevent this from happen, use this app https://splunkbase.splunk.com/app/1871/ which by default excludes this endpoint. It also allows you to reload only one specific endpoint instead of all.

Hope this helps ...

cheers, MuS

0 Karma

jawaharas
Motivator
0 Karma

lakromani
Builder

In my distributed environment, it goes to green by itself. If I do restart some of the indexer, it change yo yellow, then back to green when all are up.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!