Splunk® Enterprise

Distributed Deployment Manual

Download manual as PDF

Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Explore your deployment

You can use Splunk's Deployment Monitor app to manage and troubleshoot your distributed deployments. The home page for this app is a dashboard that provides charts with basic stats on index throughput and forwarder connections over time. It also includes warnings for unusual conditions, such as forwarders that appear to be missing from the system or indexers that aren't currently indexing any data.

The charts, warnings, and other information on the home page provide an easy way to monitor potentially serious conditions. The page itself provides guidance on what each type of warning means. For detailed information on warnings, see the topic "Troubleshoot your deployment".

Underneath each chart, there's a link, View results. Click this link to view the raw data behind the chart, as well as the originating search command. Here’s the top half of the home dashboard, with the View results links circled:

Deployment monitor start page 2.png

Note: You can modify the underlying searches for any of the charts or warnings. For example, you might want to change the scheduled search frequency to suit your specific needs. To access the chart searches, click the View results link below the chart. To access the warning searches, click the green arrow to the right of the warning.

In addition to the dashboard, the app includes several other pages that provide detailed information on indexers, forwarders, source types, and licensing. You can reach these pages from links near the top of the dashboard. See the topic "Drill for details".

About the Deployment Monitor
Troubleshoot your deployment

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters