Splunk® Enterprise

Distributed Search

Download manual as PDF

Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
Download topic as PDF

View search peer status in Settings

After you add search peers to the search head, you can view the search peers' status in Settings:

1. On the search head, click Settings at the top of the Splunk Web page.

2. Click Distributed search in the Distributed Environment area.

3. Click Search peers.

There is a row for each search peer, with the following columns:

  • Peer URI
  • Splunk instance name
  • State. Specifies whether the peer is up or down.
  • Replication status. Indicates the status of knowledge bundle replication between the search head and the search peer:
    • Initial. Default state of the peer, before the peer has received its first knowledge bundle from this search head. The peer remains in this state for approximately replication_period_sec in limits.conf, which is 60 seconds by default.
    • In Progress. A bundle replication is in progress.
    • Successful. The peer has received a bundle from this search head. The peer is ready to participate in distributed searches.
    • Failed. Something went wrong with bundle replication.
  • Cluster label. This field contains a value if this peer is part of an indexer cluster and the indexer cluster has a label.. See Set cluster labels in Monitoring Splunk Enterprise.
  • Health status. When the search head sends a heartbeat to a peer (by default, every 60 seconds), it performs a series of health checks on that peer. The results determine the health status of the peer:
    • Healthy. The peer passes all health checks during 50% or more of the heartbeats over the past 10 minutes.
    • Sick. The peer fails a health check during more than 50% of the heartbeats over the past 10 minutes. See the Health check failures column for details.
    • Quarantined. A peer that does not currently participate in distributed searches. See Quarantine a search peer.
  • Health check failures. This column provides details of any health check failures. It lists all failures over the last 10 minutes. Each heartbeat-timed set of health checks stops at the first heath check failure, so the list includes only the first failure, if any, for each heartbeat.
  • Status. Enabled or disabled.
  • Actions. You can quarantine this peer or delete it from the search head. See Quarantine a search peer and Remove a search peer.

You can also use the monitoring console to get information about the search peers. See Use the monitoring console to view distributed search status.

PREVIOUS
Remove a search peer 		  NEXT
Use the monitoring console to view distributed search status

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 8.0.0, 8.0.1, 8.0.2

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters