Data Durability Status and History

May 10, 2019•28 words

index=_internal host=indexer* OR host=cm* ((source=*splunkd.log* my guid) OR (source=*health* due_to_stanza="feature:data_searchable" color=red))
| eval type=case(match(source,"health"),"not searchable",match(source,"splunkd\.log"),"start-up")
| timechart span=1m dc(sourcetype) by type

Thanks to JonRust on Slack

👍❤️🫶👏👌🤯🤔😂😍😭😢😡😮

Subscribe to the author

You'll only receive email when they publish something new.

More from automine
All posts

Splunk dev with bump, refresh, restarts

April 22, 2019•42 words

_bump for “content files” (css/js/appserver), debug/refresh for “config changes/xml/conf” and “splunkweb restart” for persistant handlers. mod input, custom command py files are executed fresh each instantiation after the initial “pick up new things splunkd restart”. conf.spec requires restart Thanks, alacercogitatus ...

Read post

Splunk clustering status

June 19, 2019•232 words

1: STATUS_UP A peer showing no symptoms will be in the UP state this is the peak of health 2: STATUS_UNSTABLE If a peer shows concerning but tolerable symptoms it will be put in the UNSTABLE state. In this state the peer is still searched but we emit warnings about our symptoms on the bulletin board. Preempts all previous states. Currently symptoms that fall into this are: Clock skew between search head and peer. We get the peer's time from the timestamp on the Http Response headers during...

Read post

Data Durability Status and History

More from automineAll posts

Splunk dev with bump, refresh, restarts

Splunk clustering status

More from automine
All posts