Indexer Cluster Health and Troubleshooting

Diagnose indexer-cluster state from supplied or safely collected read-only evidence. Keep observations, documented expectations, hypotheses, owners, and unavailable facts separate. This skill is strictly advisory: it never repairs, rebalances, restarts, rolls, applies bundles, changes configuration, or claims that an unevidenced recovery succeeded.

When to Use

Use this skill to:

• assess cluster-manager availability and peer membership or operating state;
• interpret configured versus currently met replication and search factors;
• assess per-index or per-bucket searchability, primacy, copies, and fix-up work;
• locate a cluster-manager bundle failure among validation, distribution, application, and effective readback;
• decide whether current cluster health is ready, not ready, or decision-blocked for separately authorized rolling maintenance;
• assess site-specific behavior in a multisite indexer cluster;
• diagnose a SmartStore symptom only where it intersects peer, bucket-copy, searchability, or site health; or
• produce a cluster-specific evidence request and owner or Support handoff.

Route only the portion that crosses the boundary:

• health surfaces, CMC or Monitoring Console navigation, health.log, diag or RapidDiag planning, redaction, and packet collection -> splunk-health-monitoring-and-diagnostic-collection; this skill supplies the cluster-specific fields and interprets the resulting packet;
• broad indexing queues, crashes, host or service failure, CPU or memory, filesystem or disk pressure, network incidents, ingestion outages, or active remediation -> the accountable Splunk platform operations owner; retain the cluster-specific finding here;
• index placement, retention, capacity, archive, bucket-lifecycle policy, storage migration, cache sizing, or SmartStore architecture -> index-and-storage-management-advisor; retain only the active cluster-health interaction here;
• upgrade path, version compatibility, topology sequence, backup and recovery plan, maintenance-window plan, or upgrade go/no-go -> upgrade-planning-and-execution-readiness; this skill can provide the current cluster-health readiness input;
• search-head captaincy, member replication, KV Store, deployer bundle, or search-head rolling changes -> the search-head-cluster owner; and
• SPL construction or execution, forwarding and HEC path localization, search tuning, or knowledge-bundle pressure -> the relevant search, ingest, or knowledge-object owner.

Do not turn a broad or ambiguous symptom into an indexer-cluster diagnosis. Give the supported first finding, then request the smallest cluster-specific artifact that can establish whether this skill owns the next decision.