Use the Health dashboard

Review the status of your Splunk Cloud Platform deployment using the Health dashboard. This dashboard provides information about the overall health of the deployment and its data collection, indexing, and search performance.

The Health dashboard data updates every 3 hours. This allows the health dashboard to load data quickly. See the Last updated column to learn when the data was last updated. The health indicator View details pages update at page load time. Because of this, there might be a discrepancy between the Health dashboard main page and the health indicator details pages.

Navigate the Health dashboard

The Health dashboard offers status information and suggested actions for health indicators so you can identify metrics that need updating or optimizing.

Review the health indicator panels

Select a health indicator panel to show indicators that affect a particular health category of your Splunk Cloud Platform deployment.

Each list item shows the corresponding indicators, the health check validation criteria, the results of the health check, and the option to configure an alert for it. The individual results data for a specific indicator correlate to the Conform, Warning, and Critical totals that display in the corresponding panel.

Selecting each panel provides details on the following health categories:

• Overall health: Provides a combined summary view of your deployment's data collection, data indexing, and data search performance in context of indicators provided in the indicator table.
• Data collection: Shows deployment's universal forwarders and heavy forwarders days remaining before expiration.
• Data indexing: Shows the current state of bucket size and range per index for your deployment.
• Data search: Shows the current state of skipped search percentage, high memory searches, and cache transfer activity in your deployment.
• Security: Shows the status of the SSL/TLS implementation of your deployment based on the Security indicators listed in the indicator table.

Review health indicator toggled summary view

Select the toggle next to an indicator to view a description of what the indicator evaluates, when the indicator is marked as warning or critical, and suggested actions to maintain the health of the indicator.

Configure alerts for health indicators

CMC includes preconfigured alerts so you can get informed when health indicators reach certain thresholds. Select Configure to enable an alert. The following table describes the threshold for each health indicator preconfigured alert:

Health indicator	Alert trigger
Universal forwarder software version	When the universal forwarder software version expires within 15 days.
Heavy forwarder software version	When the heavy forwarder software version expires within 15 days.
Bucket size and range	When index bucket sizes are not well distributed.
Skipped search percentage	When the skipped search percentage exceeds 25%.
Cache transfer activity	When SmartStore download sizes exceeds 10% of total disk space.
High memory searches	When searches consume more than 10% of Splunk Cloud Platform instance memory.
TLS Error	When TLS handshake failures occur within the last hour.
Invalid TLS Certificates	When TLS handshake failures due to invalid TLS certificate occur within the last hour.
Unknown Certificate Authority Certificates	When TLS handshake failures due to unknown certificate authority (CA) certificate occur within the last hour.
Certificate Common Name Mismatches	When TLS common name mismatches occur during certificate validation within the last hour.
Incorrect TLS Protocol Versions	When TLS protocol version mismatches occur within the last hour.
TLS Cipher Suite Mismatches	When TLS cipher suite mismatches occur within the last hour.
Mutual TLS (mTLS) Certificate Verification Failures	When mTLS client certificate verification failures occur within the last hour.
Mutual TLS (mTLS) Missing Client Certificates	When handshake failures due to missing client certificate for mTLS occur within the last hour.
Missing TLS Ciphers	When missing ciphers occur in the Splunk configuration within the last hour.

Review health indicator details

In the toggled expanded view, select View details for any of the health indicators to view a drilldown of the indicator. Select a status card to filter the list by Conforming, Warning, or Critical status. The status column correlates to the Conforming, Warning, and Critical totals that display in top status cards.

The detailed view for each health indicator displays the following information:

Health indicator	Chart description	Health indicator importance
Universal forwarder software version	The Universal forwarder software version detailed views show the forwarder names, versions, days to expiration, expiration timestamp, and status.	This indicator informs you of upcoming expiry dates of your universal forwarder software version so you can maintain version compatibility with Splunk Cloud Platform. Maintaining version compatibility allows you to immediately take advantage of new capabilities and ensures uninterrupted service. The Health dashboard follows the end of full support date listed in the Splunk Support Policy.
Heavy forwarder software version	The Heavy forwarder software version detailed view shows the heavy forwarder names, versions, days to expiration, expiration timestamp, and status.	This indicator informs you of upcoming expiry dates of your heavy forwarder so you can maintain version compatibility with Splunk Cloud Platform. Maintaining version compatibility allows you to immediately take advantage of new capabilities and ensures uninterrupted service. The Health dashboard follows the end of full support date listed in the Splunk Support Policy.
Bucket size and range	The Bucket size and range detailed view shows the index, bucket type, caller, quarantined percentage, full percentage, exceeded count, small percentage, small count, total count, and status for each bucket	This indicator evaluates buckets and their size in an index to help you manage optimal bucket sizes. If bucket sizes fall below or exceed the range 375MB to 750MB, your stack might experience degraded performance from excessive cache calls. If buckets frequently exceed their maximum configured sign, it might be due to insufficient indexing capacity. Select a critical status index to view more information about source types and other bucket details. A longer period of time between event time and processing time might indicate a need for optimization.
Skipped search percentage	The Skipped search percentage detailed view shows the app, saved search, user, skip ratio, percentage skipped, reason, and status.	This indicator evaluates the skipped search ratio of all scheduled searches. A high ratio of skipped scheduled searches might indicate one of the following causes: The number of searches being run exceeds your deployment's capacity. The searches being run are taking too long or using too large amount of memory or CPU.
Cache transfer activity	The Cache transfer activity detailed view shows the index, download amount, cache churn percentage, and status.	This indicator evaluates cache download size per index and informs you when data downloaded from SmartStore exceeds 10% of total disk space. Keeping cache download size below 5% ensures proper use of infrastructure resources and prevents unnecessary cache churn that slows down searches.
High memory searches	The High memory searches detailed view shows the search IDs, memory used, percentage memory used, and status. The High memory searches detailed view returns the first 50,000 searches sorted by critical, warning, then conforming status. This prevents the results from timing out on large stacks.	This indicator evaluates search size and informs you when searches take up a large amount of memory. High memory searches might cause your Splunk Cloud Platform instance to not function if it runs out of memory.
TLS Error	The TLS Error detailed view shows instance names and the number of TLS handshake failure events within the last hour.	This indicator evaluates for the presence of TLS handshake failure alerts in the last hour, and marks as critical if they are present.
Invalid TLS Certificates	The Invalid TLS Certificates detailed view shows instance names and the number of TLS failure events within the last hour.	This indicator evaluates for the presence of TLS alerts which indicate an invalid certificate was encountered in the last hour, and marks as critical if they are present.
Unknown Certificate Authority Certificates	The Unknown Certificate Authority Certificates detailed view shows instance names and the number of unknown certificate authority (CA) certificate events with the last hour.	This indicator evaluates for the presence of TLS alerts which indicate that an unknown certificate authority (CA) certificate was detected in the last hour, and marks as critical if they are present.
Certificate Common Name Mismatches	The Certificate Common Name Mismatches detailed view shows instance names and the number of observed common name mismatches.	This indicator evaluates for the presence of events which indicate that a certificate common name mismatch occurred during certificate name validation in the last hour, and marks as critical if they are present.
Incorrect TLS Protocol Versions	The Incorrect TLS Protocol Versions detailed view shows instance names and the number of incorrect TLS protocol version events in the last hour.	This indicator evaluates for the presence of events which indicate that a TLS handshake was attempted where the server and client do not share a common TLS version in the last hour, and marks as critical if they are present.
TLS Cipher Suite Mismatches	The TLS Cipher Suite Mismatches detailed view shows instance names and the number of TLS Cipher Suite Mismatch events in the last hour.	This indicator evaluates for the presence of events which indicate a mismatch in the supported ciphers between the server and client in the last hour, and marks as critical if they are present.
Mutual TLS (mTLS) Certificate Verification Failures	The Mutual TLS (mTLS) Certificate Verification Failures detailed view shows the instance name and the number of client certificate verification failure events in the last hour.	This indicator evaluates for the presence of events which indicate that a failed client certificate verification for mutual transport layer security (mTLS) occurred in the last hour, and marks as critical if they are present.
Mutual TLS (mTLS) Missing Client Certificates	The Mutual TLS (mTLS) Missing Client Certificates detailed view shows the instance name and the number of handshake failures due to missing client certificate events in the last hour.	This indicator evaluates for the presence of events which indicate that a client failed to produce a certificate for mutual transport layer (mTLS) in the last hour, and marks as critical if they are present.
Missing TLS Ciphers	The Missing TLS Ciphers detailed view shows instance names and the number of missing TLS cipher events in the last hour.	This indicator evaluates for the presence of events which indicate that no ciphers that are compatible with the TLS version attempting to be used are present in the configuration in the last hour, and marks as critical if they are present.

Get recommended actions based on status

The Health dashboard includes help panels that provide recommended actions and information that can help you proactively update expiring forwarders, improve search queries and search time, maintain well-distributed buckets, and address SSL/TLS implementation issues.

To view a help panel, navigate to the indicator dropdown > View details > any list item. The panel provides status information, recommended action, and additional information about maintaining the health of the selected indicator.

Health indicator information and additional resources

The following table provides information on each health indicator, what the health indicator informs you of, and additional resources for further knowledge and troubleshooting:

Health indicator	Description	Additional resources
Universal forwarder software version	The universal forwarder streams data from your machine to a data receiver, formats data before sending it to your Splunk platform, and lets you monitor data in real time. Maintaining version forwarder version compatibility ensures there is no interruption to your service. This indicator evaluates the software version for all universal forwarders and informs you of upcoming expiry dates so you can maintain version compatibility.	To learn more about the universal forwarder, see About the universal forwarder in the Splunk Universal Forwarder Forwarder Manual. For details on upgrading your universal forwarder, see Upgrade your Forwarder in the Splunk Cloud Platform Admin Manual. For more information on forwarder version compatibility, see Monitor forwarder deployments in the Splunk Cloud Platform Admin Manual and Supported forwarder versions in the Splunk Cloud Platform Service Description.
Heavy forwarder software version	A heavy forwarder parses data before forwarding or indexes data locally while forwarding the data to another indexer. This indicator evaluates the software version for all heavy forwarders and informs you of upcoming expiry dates so you can maintain version compatibility.	To learn more about the heavy forwarder, see Heavy and light forwarders in the Splunk Enterprise Forwarding Data manual. For details on upgrading your heavy forwarder, see Upgrade your Forwarder in the Splunk Cloud Platform Admin Manual. For more information on forwarder version compatibility, see Monitor forwarder deployments in the Splunk Cloud Platform Admin Manual and Supported forwarder versions in the Splunk Cloud Platform Service Description.
High memory searches	High memory searches use a significant amount of your Splunk platform instance memory. This indicator evaluates search size and informs you of when searches take up a high amount of memory.	See the Expensive searches dashboard in the CMC for more details about searches that are using a lot of memory. To learn more about how to troubleshoot high memory, see Limit search process memory usage in the Splunk Cloud Platform Search Manual. For information on how to write more efficient searches, see Write better searches in the Splunk Cloud Platform Search Manual.
Bucket size and range	An index typically consists of buckets, directories that contain processed external data and index files. This indicator evaluates buckets and their size in an index to help you manage optimal bucket sizes.	To learn more about buckets and how they work in an index, see How the indexer stores indexes in the Splunk Enterprise Managing Indexers and Clusters of Indexers manual.
Skipped search percentage	Skipped searches occur when the load on your system is higher than the available resources. This indicator evaluates the skipped search ratio of all scheduled searches.	To learn more about why searches are being skipped and how to avoid skipped searches, see Are you Skipping? Please read!. To investigate skipped scheduled searches, use the Search > Skipped scheduled searches dashboard. See the documentation at Investigate skipped scheduled searches to learn how to review this dashboard.
Cache transfer activity	Cache transfer activity refers to your deployment's local storage, aggregated by bucket size. This indicator evaluates bucket download size and informs you of high download size so you can optimize your deployment's cache transfer activity.	To investigate cache transfer activity further, use the Search > Search usage statistics dashboard.
TLS Errors	TLS (Transport Layer Security) is a widely-used cryptographic security protocol that the Splunk platform uses to ensure secure communication between Splunk platform instances over network connections. This indicator evaluates for TLS handshake failure alerts. TLS errors can occur for a variety of reasons, including if TLS is not activated on both client and server. TLS errors can also occur if common attributes, such TLS protocol version, cipher suites, and other configurable TLS values, do no match on client and server.	For an overview of how the Splunk platform uses TLS to secure your deployment, see Introduction to securing the Splunk platform with TLS. For detailed information on how to implement TLS for your deployment, see Steps for securing your Splunk Enterprise deployment with TLS.
Invalid TLS Certificates	A TLS certificate is a digital certificate that encrypts and authenticates data transmitted between a client and server, ensuring secure network communications. This indicator evaluates for invalid TLS certificates. An invalid TLS certificate alert can occur due to incorrect certificate configuration, expired certificates, or out-of-sync system clocks on client and server nodes.	For information on how to verify valid TLS certificates, see Steps for securing your Splunk Enterprise deployment with TLS. For an overview on securing your deployment with TLS, see Introduction to securing the Splunk platform with TLS.
Unknown Certificate Authority Certificates	A certificate authority (CA) certificate is a digital certificate issued by a trusted entity that verifies the authenticity of TLS certificates. This indicator evaluates for unknown certificate authority (CA) certificates. An unknown certificate authority (CA) certificate alert can occur due to incorrect configuration settings or if no valid certificate authority (CA) certificate file exists in the certificate trust store.	For details on how to configure TLS certificates for your deployment, see configure TLS certificates for inter-Splunk communication.
Certificate Common Name Mismatches	A certificate common name (CN) is an attribute of a TLS certificate that specifies the identify of the certificate holder, such as a fully qualified domain name (FQDN), ensuring the entity matches the expected identity during secure communications. This indicator evaluates for common name (CN) mismatches during certificate validation. Certificate common name mismatch alerts can occur if the CN value of the certificate presented in the TLS handshake does not match the CN value in the 'sslCommonNameToCheck' setting in server.conf.	For more information on TLS configuration settings for Splunk platform deployments, see configure TLS certificates for inter-Splunk communication.
Incorrect TLS Protocol Versions	The Splunk platform supports TLS protocol version 1.2. Splunk has deprecated TLS protocol versions 1.0, 1.1 and SSL version 3.0. This indicator evaluates for events that indicate the server and client do not share a common TLS version. To avoid TLS protocol version mismatches, make sure the 'sslVersions' in the respective configuration file stanza has a value of "tls.2".	For more information on supported TLS protocol versions, see Configure TLS protocol version support for secure connections between Splunk platform instances.
TLS Cipher Suite Mismatches	A TLS cipher suite is a set of cryptographic algorithms that govern the encryption, authentication, and integrity of data over secure network connections. This indicator evaluates for mismatches in TLS ciphers between server and client. TLS cipher suite mismatches can occur if the 'cipherSuite' setting in server.conf on the server and client do not share a compatible TLS cipher.	For information on TLS cipher suite configuration in Splunk platform, see the 'cipherSuite' setting under TLS/SSL Configuration details in server.conf.
Mutual TLS (mTLS) Certificate Verification Failures	Mutual TLS (mTLS) is a security protocol that requires both client and server to authenticate each other's identity using digital certificates. This indicator evaluates for events that indicate a failed mTLS certificate verification. Such failures can occur due to certificate expiration, incorrect certificate configuration, or Certificate Authority (CA) trust issues.	For information on how to update TLS certificates for your deployment, see Renew existing TLS certificates.
Mutual TLS (mTLS) Missing Client Certificates	Mutual TLS (mTLS) is a security protocol that requires both client and server to authenticate each other's identity using digital certificates. This indicator evaluates for events that indicate a client failed to produce a certificate for mutual transport layer security (mTLS). Such failures can occur if the client is not configured to present a client certificate.	For information on how to configure TLS certificates for your deployment, see configure TLS certificates for inter-Splunk communication.
Missing TLS Ciphers	A TLS cipher is an algorithm used to encrypt and decrypt data within a TLS-secured communication. This indicator evaluates for events that indicate no ciphers compatible with the TLS version exist in the configuration. Missing TLS cipher alerts can occur when the 'cipherSuites' setting in the client configuration does not have a cipher compatible with the TLS version.	For more information on TLS cipher configuration, see TLS/SSL Configuration details in server.conf.

Provide feedback

You can provide feedback and ask questions directly from the Health dashboard. Select the Feedback button to ask the Splunk community a question or submit an idea for the Splunk team.