Why is my Splunk destination showing unhealthy when the individual workers are showing a green healthy status?
There are a couple of Cribl BUG that are contributing to this behaviour.
The monitoring dashboard for destinations is showing the health from the earliest timestamp of the range, instead of the latest. This means, with a 1h time selection, the health status is delayed by an hour.
The Health metrics were disabled due to a performance issue with the GUI when the numbers of workers exceed 50+ workers as per CRIBL-17756 and on the destination page we default to the warning status.
Thanks! I look forward to the fixes!
CRIBL-18868: Has been fixed in v4.4.2
CRIBL-12259: Has been fixed in v4.3.0