View search peer status in Settings

After you add search peers to the search head, you can view the search peers' status in Settings:

1. On the search head, click Settings at the top of the Splunk Web page.

2. Click Distributed search in the Distributed Environment area.

3. Click Search peers.

There is a row for each search peer, with the following columns:

• Peer URI
• Splunk instance name
• State. Specifies whether the peer is up or down.
• Replication status. Indicates the status of knowledge bundle replication between the search head and the search peer:
  • Initial. Default state of the peer, before the peer has received its first knowledge bundle from this search head. The peer remains in this state for approximately replication_period_sec in limits.conf, which is 60 seconds by default.
  • In Progress. A bundle replication is in progress.
  • Successful. The peer has received a bundle from this search head. The peer is ready to participate in distributed searches.
  • Failed. Something went wrong with bundle replication.
• Cluster label. This field contains a value if this peer is part of an indexer cluster and the indexer cluster has a label.. See Set cluster labels in Monitoring Splunk Enterprise.
• Health status. When the search head sends a heartbeat to a peer (by default, every 60 seconds), it performs a series of health checks on that peer. The results determine the health status of the peer:
  • Healthy. The peer passes all health checks during 50% or more of the heartbeats over the past 10 minutes.
  • Sick. The peer fails a health check during more than 50% of the heartbeats over the past 10 minutes. See the Health check failures column for details.
  • Quarantined. A peer that does not currently participate in distributed searches. See Quarantine a search peer.
• Health check failures. This column provides details of any health check failures. It lists all failures over the last 10 minutes. Each heartbeat-timed set of health checks stops at the first heath check failure, so the list includes only the first failure, if any, for each heartbeat.
• Status. Enabled or disabled.
• Actions. You can quarantine this peer or delete it from the search head. See Quarantine a search peer and Remove a search peer.

You can also use the monitoring console to get information about the search peers. See Use the monitoring console to view distributed search status.