Data Collection Monitor
Overview
Details
This app is a utility for Splunk administrators, which contains dashboards for performing validations before and after maintenance activities related to work performed at the data collection layer.
Usage
This app contains three dashboards, made to compliment the Monitoring Console during maintenance activities involving data sources for pre- and post-validations.
Forwarder Troubleshooter
Reviews internal logs and metrics for troubleshooting common forwarder issues. Check this dashboard when performing maintenance activities on forwarders. Includes forwarder information, throughput metrics, stops and starts, index/sourcetype/source details, health status, resource usage, and splunkd logs.
Data Source Troubleshooter
Reviews internal logs and metrics for troubleshooting common data source issues. Check this dashboard when deploying configuration changes to data sources. Includes tstats data over time, as well as detected issues with permissions, enqueuing, timestamp parsing, line breaking, aggregation, future timestamps, and time disparity.
Deployment Clients
Reviews REST API data from the Deployment Server(s), extending the information given by Forwarder Management. Includes a similar interface to Forwarder Management for monitoring multiple Deployment Servers, with many filters and extended information of both Deployment Clients and Servers.
Installation
Install this app on a search head, preferably on the Splunk Enterprise instance hosting the distributed Monitoring Console. App will not fully function without peering with the Indexing tier and Deployment Server.
About
Data Collection Monitor
by Joe Misner
http://tools.misner.net/
Release Notes
Version 0.1.0
Initial release