Splunk® App for Infrastructure (Legacy)

Administer Splunk App for Infrastructure

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

The status of an entity is not updating

When an entity stops sending data, the status of the entity changes to Inactive. If the entity starts sending data after an extended period of time of not sending data, the status may not automatically change to Active.

To force an update of the status for an entity, delete the entity from the Splunk App for Infrastructure (SAI). After you delete the entity, it reappears in SAI as long as the data collection agents on the host machine are sending data to SAI. If deleting the entity does not update its status when SAI rediscovers it, restart the Splunk Enterprise instance that is running SAI. When you restart the instance, the app refreshes the status of every entity.

Delete the host from SAI

Delete the host from SAI so the app rediscovers the host machine that is sending data to SAI.

Prerequisites

Steps

Follow these steps to manually delete an entity from SAI.

  1. Log in to Splunk Web.
  2. Go to SAI.
  3. Select the Investigate tab.
  4. Select each entity that is displaying an inaccurate Status.
  5. In the Actions column, select Delete. If you selected multiple entities, click the Bulk actions drop-down menu and select Delete Selected Entities.

Restart Splunk Enterprise

Restart the Splunk Enterprise instance that is running SAI. This forces an update for every entity that is sending data to SAI.

Prerequisites

  • Administrator access to the system that is running SAI.

Steps

Follow these steps to restart the Splunk Enterprise instance that is running SAI. For more information about stopping, starting, and restarting Splunk software, including restarting an instance in Splunk Web, see Start and stop Splunk Enterprise in the Splunk Enterprise Admin Manual.

  1. On the system that is running SAI, open a command line terminal.
  2. Go to the $SPLUNK_HOME/bin directory.
  3. Restart the Splunk Enterprise instance:
    $ ./splunk restart
    
Last modified on 08 July, 2020
PREVIOUS
Collectd DF Plugin not generating output on Linux with XFS file system
  NEXT
Manage and debug the local server in Splunk App for Infrastructure

This documentation applies to the following versions of Splunk® App for Infrastructure (Legacy): 1.3.1, 1.4.0, 1.4.1, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.0, 2.1.1 Cloud only, 2.2.0 Cloud only, 2.2.1, 2.2.3 Cloud only, 2.2.4, 2.2.5


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters