View search peer status in Settings
After you add search peers to the search head, you can view the search peers' status in Settings:
1. On the search head, click Settings at the top of the Splunk Web page.
2. Click Distributed search in the Distributed Environment area.
3. Click Search peers.
There is a row for each search peer, with the following columns:
- Peer URI
- Splunk instance name
- State. Specifies whether the peer is up or down.
- Replication status. Indicates the status of knowledge bundle replication between the search head and the search peer:
- Initial. Default state of the peer, before the peer has received its first knowledge bundle from this search head. The peer remains in this state for approximately
replication_period_sec
inlimits.conf
, which is 60 seconds by default. - In Progress. A bundle replication is in progress.
- Successful. The peer has received a bundle from this search head. The peer is ready to participate in distributed searches.
- Failed. Something went wrong with bundle replication.
- Initial. Default state of the peer, before the peer has received its first knowledge bundle from this search head. The peer remains in this state for approximately
- Cluster label. This field contains a value if this peer is part of an indexer cluster and the indexer cluster has a label.. See Set cluster labels in Monitoring Splunk Enterprise.
- Health status. When the search head sends a heartbeat to a peer (by default, every 60 seconds), it performs a series of health checks on that peer. The results determine the health status of the peer:
- Healthy. The peer passes all health checks during 50% or more of the heartbeats over the past 10 minutes.
- Sick. The peer fails a health check during more than 50% of the heartbeats over the past 10 minutes. See the Health check failures column for details.
- Quarantined. A peer that does not currently participate in distributed searches. See Quarantine a search peer.
- Health check failures. This column provides details of any health check failures. It lists all failures over the last 10 minutes. Each heartbeat-timed set of health checks stops at the first heath check failure, so the list includes only the first failure, if any, for each heartbeat.
- Status. Enabled or disabled.
- Actions. You can quarantine this peer or delete it from the search head. See Quarantine a search peer and Remove a search peer.
You can also use the monitoring console to get information about the search peers. See Use the monitoring console to view distributed search status.
Remove a search peer | Use the monitoring console to view distributed search status |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1
Feedback submitted, thanks!