The Splunk Health Overview app helps you easily manage your Splunk environment and provides a high level overview of key metrics.

It features several helpful views:

Health Status
License Overview
Search Activity
Resource Usage
Scheduler Activity
User Activity
Available Indexes
Indexes and Fields


The Splunk Monitoring App Focuses on the following areas:

Health Status – status of your instances, forwarders, data feeds, and internal messages.
License Overview – shows the status of your license usage, license trending, and index and indexer capacity - takes advantage of the Internal Events data model.
Resource Usage - uses the Introspection Usage data model for a look into Splunk and system resource usage.
Search Activity – illustrates what users are searching in your environment and allows you to easily identify poorly written searches.
Scheduler Activity – information regarding job schedules.
User Activity – information regarding user activity.
Available Indexes – shows what indexes and source types are in your environment with a custom contextual drill down capability that launches a new search with the index/sourcetype in question defined. This has proven very successful as users no longer have to run expensive exploratory searches to determine what indexes and sourcetypes are available to their role.
Indexes and Fields - Contains detail regarding field extractions for sourcetypes and the fields that are extracted.

Getting Started:

Once the app is installed a restart is required. After the restart you will need to run two of the scheduled saved searches avail_indexes and all_servers. These two lookups will gather information regarding your environment and are crucial to the apps functionality. If the all_servers lookup does not generate accurate information in your environment you will need to manually edit this.

Other Gotchas:
There is an Internal Events and Introspection accelerated data model will will need to complete acceleration.

You can customized thresholds based on your license capacity. By default, the filler gauge is set to 10 GB.

Splunk instances running on Mac OSX do not generate Introspection data.

Each instance that wants to be monitored will need to be a search peer so Splunk can collect the role information from that host. If it is not setup as a peer Splunk can still collect information regarding that host granted it is sending data to a host that is a Splunk search peer but will not show information generated from REST.

Currently only supported on Splunk 6.1+. To get this app functioning with 6.0.x you will need remove the panel tags from the xml views and remove any panel embedded time range picker as well as any multiselect inputs.


Special thanks to Sanford Owings and Vlad Skoryk.
