The Splunk Health Overview app helps you easily manage your Splunk environment and provides a high level overview of key metrics.
It features several helpful views:
Health Status
License Overview
Search Activity
Resource Usage
Scheduler Activity
User Activity
Available Indexes
Indexes and Fields
The Splunk Monitoring App Focuses on the following areas:
Health Status – status of your instances, forwarders, data feeds, and internal messages.
License Overview – shows the status of your license usage, license trending, and index and indexer capacity - takes advantage of the Internal Events data model.
Resource Usage - uses the Introspection Usage data model for a look into Splunk and system resource usage.
Search Activity – illustrates what users are searching in your environment and allows you to easily identify poorly written searches.
Scheduler Activity – information regarding job schedules.
User Activity – information regarding user activity.
Available Indexes – shows what indexes and source types are in your environment with a custom contextual drill down capability that launches a new search with the index/sourcetype in question defined. This has proven very successful as users no longer have to run expensive exploratory searches to determine what indexes and sourcetypes are available to their role.
Indexes and Fields - Contains detail regarding field extractions for sourcetypes and the fields that are extracted.
Getting Started:
Once the app is installed a restart is required. After the restart you will need to run two of the scheduled saved searches avail_indexes and all_servers. These two lookups will gather information regarding your environment and are crucial to the apps functionality. If the all_servers lookup does not generate accurate information in your environment you will need to manually edit this. For 6.1.x environments enable the server_lookup_v6_1 saved search and disable the default server_lookup saved search.
Other Gotchas:
There is an Internal Events and Introspection accelerated data model will will need to complete acceleration.
You can customized thresholds based on your license capacity. By default, the filler gauge is set to 10 GB.
Splunk instances running on Mac OSX do not generate Introspection data.
Each instance to be monitored will need to be a search peer so Splunk can collect the role information from that host. If it is not setup as a peer Splunk can still collect information regarding that host granted it is sending data to a host that is a Splunk search peer but will not show information generated from REST.
Currently only supported on Splunk 6.1+. To get this app functioning with 6.0.x you will need remove the panel tags from the xml views and remove any panel embedded time range picker as well as any multiselect inputs.
Special thanks to Sanford Owings and Vlad Skoryk.
Updated issue with deployment status drop downs and updated license usage overview with host option.
Updated Saved Search Detail page to illustrate unused or stale saved searches.
The Splunk Health Overview app helps you easily manage your Splunk environment and provides a high level overview of key metrics.
It features several helpful views:
Health Status
License Overview
Search Activity
Resource Usage
Scheduler Activity
User Activity
Available Indexes
Indexes and Fields
The Splunk Monitoring App Focuses on the following areas:
Health Status – status of your instances, forwarders, data feeds, and internal messages.
License Overview – shows the status of your license usage, license trending, and index and indexer capacity - takes advantage of the Internal Events data model.
Resource Usage - uses the Introspection Usage data model for a look into Splunk and system resource usage.
Search Activity – illustrates what users are searching in your environment and allows you to easily identify poorly written searches.
Scheduler Activity – information regarding job schedules.
User Activity – information regarding user activity.
Available Indexes – shows what indexes and source types are in your environment with a custom contextual drill down capability that launches a new search with the index/sourcetype in question defined. This has proven very successful as users no longer have to run expensive exploratory searches to determine what indexes and sourcetypes are available to their role.
Indexes and Fields - Contains detail regarding field extractions for sourcetypes and the fields that are extracted.
Getting Started:
Once the app is installed a restart is required. After the restart you will need to run two of the scheduled saved searches avail_indexes and all_servers. These two lookups will gather information regarding your environment and are crucial to the apps functionality. If the all_servers lookup does not generate accurate information in your environment you will need to manually edit this. For 6.1.x environments you will need to enable and run the server_lookup_v6_1 saved search and disable the server_lookup search.
Other Gotchas:
There is an Internal Events and Introspection accelerated data model will will need to complete acceleration.
You can customize thresholds based on your license capacity. By default, the filler gauge is set to 10 GB.
Splunk instances running on Mac OSX do not generate Introspection data.
Each instance to be monitored will need to be a search peer so Splunk can collect the role information from that host. If it is not setup as a peer Splunk can still collect information regarding that host granted it is sending data to a host that is a Splunk search peer but will not show information generated from REST.
Special thanks to Sanford Owings and Vlad Skoryk.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.