Troubleshoot with integrated Splunk deployment health report

The Summary dashboard in the Monitoring Console lets you troubleshoot health issues with your Splunk Enterprise deployment that the splunkd health report detects. The Mode label in each dashboard indicates a standalone or distributed instance associated with the Anomalies.

Investigate feature health issues

The Anomalies panel in the Summary dashboard lists splunkd health report features that are currently in the red or yellow state. Features in the red or yellow state can indicate a serious issue with your deployment. Use the Anomalies panel to review descriptions of each issue, and access health checks to investigate root cause.

To investigate feature health issues:

1. Click Settings > Monitoring Console > Summary.
2. In the Anomalies panel, review the descriptions of listed features in the read and yellow state.
3. To further investigate a specific issue, click Investigate.

The Health Check page will open. The page shows recommended health checks relating to the reported issue.

4. Run the recommended health checks to get information on root cause and suggested fixes for the issue.

Example: Investigate skipped searches

This example illustrates how to use the Summary dashboard to troubleshoot a critical health status issue detected by the splunkd health report.

1. Click Settings > Monitoring Console > Summary.
2. In the Anomalies panel, the "skipped searches" feature appears in the critical "red" state.
   This indicates that there is a severe issue that is negatively impacting search performance.
3. Review the description provided by the splunkd health report for basic information about the issue.
4. Click Investigate.
   The Health Check page opens showing health checks recommended for investigating "Search scheduler skip ratio", "Orphaned scheduled searches", and "resource usage".
5. Run the recommended health checks.
   The "Search scheduler skip ratio" health check fails.
6. Click on the failed health check to view the health check results, information about the cause of the problem, and suggested actions for fixing the problem.
7. See the following Monitoring Console dashboards to perform further root cause analysis: Search > Scheduler Activity: Instance/Deployment, Resource Usage: Instance/Deployment.

For more information on updatable health checks, see Download health check updates.

For more information on the splunkd health report, see About pro-active Splunk component monitoring.