View search peer status in Settings

After you add search peers to the search head, you can view the search peers' status in Settings:

1. On the search head, click Settings at the top of the Splunk Web page.

2. Click Distributed search in the Distributed Environment area.

3. Click Search peers.

There is a row for each search peer, with the following columns:

  • Peer URI
  • Splunk instance name
  • State. Specifies whether the peer is up or down.
  • Replication status. Indicates the status of knowledge bundle replication between the search head and the search peer:
    • Initial. Default state of the peer, before the peer has received its first knowledge bundle from this search head. The peer remains in this state for approximately replication_period_sec in limits.conf, which is 60 seconds by default.
    • In Progress. A bundle replication is in progress.
    • Successful. The peer has received a bundle from this search head. The peer is ready to participate in distributed searches.
    • Failed. Something went wrong with bundle replication.
  • Cluster label. This field contains a value if this peer is part of an indexer cluster and the indexer cluster has a label.. See Set cluster labels in Monitoring Splunk Enterprise.
  • Health status. When the search head sends a heartbeat to a peer (by default, every 60 seconds), it performs a series of health checks on that peer. The results determine the health status of the peer:
    • Healthy. The peer passes all health checks during 50% or more of the heartbeats over the past 10 minutes.
    • Sick. The peer fails a health check during more than 50% of the heartbeats over the past 10 minutes. See the Health check failures column for details.
    • Quarantined. A peer that does not currently participate in distributed searches. See Quarantine a search peer.
  • Health check failures. This column provides details of any health check failures. It lists all failures over the last 10 minutes. Each heartbeat-timed set of health checks stops at the first heath check failure, so the list includes only the first failure, if any, for each heartbeat.
  • Status. Enabled or disabled.
  • Actions. You can quarantine this peer or delete it from the search head. See Quarantine a search peer and Remove a search peer.

You can also use the monitoring console to get information about the search peers. See Use the monitoring console to view distributed search status.