icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Splunk Health Check Overview
SHA256 checksum (splunk-health-check-overview_221.tgz) 01da4686bdfde8c5a5b5a9bb15393882569676fbbdb51faedacd1512ef11d0b5 SHA256 checksum (splunk-health-check-overview_22.tgz) af8108a7ec0f45f4267e662ac0483d8226e7ebb01d963a9f5ae73b79527d2315 SHA256 checksum (splunk-health-check-overview_214.tgz) b7712c33278886b9868f2ca7d842c4725bd19dffc88fb58c1c33a83aaa4427d2 SHA256 checksum (splunk-health-check-overview_213.tgz) 87aa3559185ffc70cb8c5ab0f19f63449ac5298605eb1e1f811076c679461006 SHA256 checksum (splunk-health-check-overview_212.tgz) 2647d6daf64537d659b56215023c767bea90444df0e017dc6a59dab3ebbb8a4e SHA256 checksum (splunk-health-check-overview_211.tgz) f1f7e2e9fb78975c26dfb5c3cc042c5f7008e60ad93a6beda31ff7a0103939bc SHA256 checksum (splunk-health-check-overview_21.tgz) 855f2c56e9db77378e57b0333debff7adb591b17cc1b88db1240cb8a3ffa7011 SHA256 checksum (splunk-health-check-overview_20.tgz) 913e61d86b22e8a34a9db14dec0924ee36db9092c565ba902c9fecfdc2aa5330
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Splunk Health Check Overview

Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
The Splunk Health Overview app provides visibility into your deployment’s health through license usage, resource usage, server status, usage patterns, and search activity.

The Splunk Health Overview app helps you easily manage your Splunk environment and provides a high level overview of key metrics.

It features several helpful views:

Health Status
License Overview
Search Activity
Resource Usage
Scheduler Activity
User Activity
Available Indexes
Indexes and Fields

The Splunk Monitoring App Focuses on the following areas:

Health Status – status of your instances, forwarders, data feeds, and internal messages.
License Overview – shows the status of your license usage, license trending, and index and indexer capacity - takes advantage of the Internal Events data model.
Resource Usage - uses the Introspection Usage data model for a look into Splunk and system resource usage.
Search Activity – illustrates what users are searching in your environment and allows you to easily identify poorly written searches.
Scheduler Activity – information regarding job schedules.
User Activity – information regarding user activity.
Available Indexes – shows what indexes and source types are in your environment with a custom contextual drill down capability that launches a new search with the index/sourcetype in question defined. This has proven very successful as users no longer have to run expensive exploratory searches to determine what indexes and sourcetypes are available to their role.
Indexes and Fields - Contains detail regarding field extractions for sourcetypes and the fields that are extracted.

Getting Started:

Once the app is installed a restart is required. After the restart you will need to run two of the scheduled saved searches avail_indexes and all_servers. These two lookups will gather information regarding your environment and are crucial to the apps functionality. If the all_servers lookup does not generate accurate information in your environment you will need to manually edit this. For 6.1.x environments enable the server_lookup_v6_1 saved search and disable the default server_lookup saved search.

Other Gotchas:
There is an Internal Events and Introspection accelerated data model will will need to complete acceleration.

You can customized thresholds based on your license capacity. By default, the filler gauge is set to 10 GB.

Splunk instances running on Mac OSX do not generate Introspection data.

Each instance to be monitored will need to be a search peer so Splunk can collect the role information from that host. If it is not setup as a peer Splunk can still collect information regarding that host granted it is sending data to a host that is a Splunk search peer but will not show information generated from REST.

Currently only supported on Splunk 6.1+. To get this app functioning with 6.0.x you will need remove the panel tags from the xml views and remove any panel embedded time range picker as well as any multiselect inputs.

Special thanks to Sanford Owings and Vlad Skoryk.

Release Notes

Version 2.2.1
July 12, 2015

Updated issue with deployment status drop downs and updated license usage overview with host option.

Version 2.2
June 23, 2015

Version 2.1.4
Jan. 9, 2015

Updated Saved Search Detail page to illustrate unused or stale saved searches.

Version 2.1.3
Dec. 16, 2014

Version 2.1.2
Dec. 16, 2014

Version 2.1.1
Dec. 16, 2014

Version 2.1
Dec. 16, 2014

Version 2.0
Dec. 3, 2014

The Splunk Health Overview app helps you easily manage your Splunk environment and provides a high level overview of key metrics.

It features several helpful views:

Health Status
License Overview
Search Activity
Resource Usage
Scheduler Activity
User Activity
Available Indexes
Indexes and Fields


The Splunk Monitoring App Focuses on the following areas:

Health Status – status of your instances, forwarders, data feeds, and internal messages.
License Overview – shows the status of your license usage, license trending, and index and indexer capacity - takes advantage of the Internal Events data model.
Resource Usage - uses the Introspection Usage data model for a look into Splunk and system resource usage.
Search Activity – illustrates what users are searching in your environment and allows you to easily identify poorly written searches.
Scheduler Activity – information regarding job schedules.
User Activity – information regarding user activity.
Available Indexes – shows what indexes and source types are in your environment with a custom contextual drill down capability that launches a new search with the index/sourcetype in question defined. This has proven very successful as users no longer have to run expensive exploratory searches to determine what indexes and sourcetypes are available to their role.
Indexes and Fields - Contains detail regarding field extractions for sourcetypes and the fields that are extracted.

Getting Started:

Once the app is installed a restart is required. After the restart you will need to run two of the scheduled saved searches avail_indexes and all_servers. These two lookups will gather information regarding your environment and are crucial to the apps functionality. If the all_servers lookup does not generate accurate information in your environment you will need to manually edit this. For 6.1.x environments you will need to enable and run the server_lookup_v6_1 saved search and disable the server_lookup search.

Other Gotchas:
There is an Internal Events and Introspection accelerated data model will will need to complete acceleration.

You can customize thresholds based on your license capacity. By default, the filler gauge is set to 10 GB.

Splunk instances running on Mac OSX do not generate Introspection data.

Each instance to be monitored will need to be a search peer so Splunk can collect the role information from that host. If it is not setup as a peer Splunk can still collect information regarding that host granted it is sending data to a host that is a Splunk search peer but will not show information generated from REST.

Special thanks to Sanford Owings and Vlad Skoryk.

404
Installs
3,758
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2019 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.