We have Splunk DB Connect 2 installed on two heavy forwarders, but the health dashboards work on none ("no results found"). We have another environment with DB Connect installed on the search head. In that case, the dashboard seems to work fine.
I know that the internal logs from the heavy forwarders are forwarded to our indexers. Is that the reason why the heath dashboard won't work?
Note: I also don't see any errors when I click the "RPC Service", (which also runs a search on the internal index).
I believe its standard practice to forward internal logs from HFs to indexer. In that case, what is the point of the health dashboard on a distributed environment? (This is of course assuming that my analysis of the problem is correct in the first place).
Splunk support were not able to suggest any solutions when we raised this as a case. They advised upgrading the app, which we did (from 2.0.3 to 2.1.1). This made no difference to the issue.
↧