
View search peer status in Settings
After you add search peers to the search head, you can view the search peers' status in Settings:
1. On the search head, click Settings at the top of the Splunk Web page.
2. Click Distributed search in the Distributed Environment area.
3. Click Search peers.
There is a row for each search peer, with the following columns:
- Peer URI
- Splunk instance name
- State. Specifies whether the peer is up or down.
- Replication status. Indicates the status of knowledge bundle replication between the search head and the search peer:
- Initial. Default state of the peer, before the peer has received its first knowledge bundle from this search head. The peer remains in this state for approximately
replication_period_sec
inlimits.conf
, which is 60 seconds by default. - In Progress. A bundle replication is in progress.
- Successful. The peer has received a bundle from this search head. The peer is ready to participate in distributed searches.
- Failed. Something went wrong with bundle replication.
- Initial. Default state of the peer, before the peer has received its first knowledge bundle from this search head. The peer remains in this state for approximately
- Cluster label. This field contains a value if this peer is part of an indexer cluster and the indexer cluster has a label.. See Set cluster labels in Monitoring Splunk Enterprise.
- Health status. When the search head sends a heartbeat to a peer (by default, every 60 seconds), it performs a series of health checks on that peer. The results determine the health status of the peer:
- Healthy. The peer passes all health checks during 50% or more of the heartbeats over the past 10 minutes.
- Sick. The peer fails a health check during more than 50% of the heartbeats over the past 10 minutes. See the Health check failures column for details.
- Quarantined. A peer that does not currently participate in distributed searches. See Quarantine a search peer.
- Health check failures. This column provides details of any health check failures. It lists all failures over the last 10 minutes. Each heartbeat-timed set of health checks stops at the first heath check failure, so the list includes only the first failure, if any, for each heartbeat.
- Status. Enabled or disabled.
- Actions. You can quarantine this peer or delete it from the search head. See Quarantine a search peer and Remove a search peer.
You can also use the monitoring console to get information about the search peers. See Use the monitoring console to view distributed search status.
PREVIOUS Remove a search peer |
NEXT Use the monitoring console to view distributed search status |
This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 8.0.0, 8.0.1
Feedback submitted, thanks!