Splunk destination health not matching individual worker node health in destination
Why is my Splunk destination showing unhealthy when the individual workers are showing a green healthy status?
Best Answer
-
There are a couple of Cribl BUG that are contributing to this behaviour.
CRIBL-18868:
The monitoring dashboard for destinations is showing the health from the earliest timestamp of the range, instead of the latest. This means, with a 1h time selection, the health status is delayed by an hour.
CRIBL-12259:
The Health metrics were disabled due to a performance issue with the GUI when the numbers of workers exceed 50+ workers as per CRIBL-17756 and on the destination page we default to the warning status.0
Answers
-
There are a couple of Cribl BUG that are contributing to this behaviour.
CRIBL-18868:
The monitoring dashboard for destinations is showing the health from the earliest timestamp of the range, instead of the latest. This means, with a 1h time selection, the health status is delayed by an hour.
CRIBL-12259:
The Health metrics were disabled due to a performance issue with the GUI when the numbers of workers exceed 50+ workers as per CRIBL-17756 and on the destination page we default to the warning status.0 -
Thanks! I look forward to the fixes!
0 -
CRIBL-18868: Has been fixed in v4.4.2
CRIBL-12259: Has been fixed in v4.3.00