Enable agents lookup

Improve the loading performance of the agent management UI by enabling the agents lookup through scheduling the relevant saved search.

To make sure that all information about your agents is displayed on UI, you have to set values for some attributes in the the limits.conf file that is located in $SPLUNK_HOME/etc/system/local/limits.conf:
  • Lookup displays up to 10,000 agents by default. To increase this limits update the following settings:

    • maxout setting under the [subsearch] stanza.

    • maxresultrows under the [searchresults] stanza if you have more than 50,000 agents.

    • subsearch_maxout under the [join] stanza if you have more than 50,000 agents. The upper limit is 75,000.

  • By default, agent lookup displays up to 100 applications per agent. To increase this limit, update the list_maxsize setting under the [stats] stanza if you expect more than 100 applications assigned to a single agent.

For more information, see Troubleshoot agents lookup issues.

The agents lookup is enabled by scheduling the DeploymentServerCreateAgentsLookup saved search.

  1. Log in to Splunk Web.
  2. From the top menu, select Settings > Searches, reports, and alerts.
  3. On the Searches, Reports, and Alerts page, change the App filter to SplunkDeploymentServerConfig.
  4. Change the Owner filter to All.

    The saved searches used by agent management are displayed.

  5. Find the saved search named DeploymentServerCreateAgentsLookup.
  6. In the row for this saved search, select the Edit drop-down list, and then select Edit Schedule.
  7. In the Edit Schedule window, select the Schedule Report checkbox.
  8. Set the schedule frequency:

    • From the Schedule drop-down list, select a predefined frequency.

    • Select Run on Cron Schedule to enter a custom value in the Cron Expression field.

    Note: The frequency you set directly impacts the freshness of the data displayed in the UI. For example, if you set the schedule to Run every hour, the data you see in the UI could be up to one hour old.
  9. Select Save to apply your changes.

The agents lookup is now enabled and scheduled to run at the specified frequency.

(Optional) To check the last time the data was updated, locate the DeploymentServerCreateAgentsLookup saved search again and select View recent. The Job Management page opens, showing recent executions of the job and their creation times.