I85PREP
⌘ K
Splunk Enterprise Certified Admin study materials
Splunk Enterprise Certified Admin study resources

Splunk Enterprise Certified Admin: Monitoring Splunk

Splunk Enterprise Certified Admin · Work through your exam, one topic at a time.

All guide sections

Monitoring Splunk

Where the signals are

Splunk monitors itself through internal indexes and endpoints: _internal (splunkd.log, metrics.log, and other component logs), _audit (user activity), _introspection (resource usage from introspection generators), and _telemetry. The Monitoring Console, a bundled app typically run on a search head, aggregates health checks, license usage, indexer clustering status, deployment status, and disk/CPU trends across the deployment.

What admins check regularly

  • License usage and projected volume against quota.
  • Index growth, bucket counts, and free disk space.
  • Search performance: concurrency, skipped searches, limits.conf saturation.
  • Forwarder connectivity and last phone-home time.
  • Cluster status (peers, bucket fixup) and SHC captain health.

Tools

splunk status, splunk diag for support bundles, splunk btool for effective configuration, splunk list monitor, and | rest calls against /services/... endpoints. Introspection must be enabled and configured on the components you want data from, and the Monitoring Console must be pointed at the correct distributed environment.

Traps

  • Searching _internal with no time bound or sourcetype filter - the volume is large and retention is short.
  • Assuming the Monitoring Console collects data itself; it queries distributed components.
  • Losing evidence because _internal retention is short on busy systems.

Rule of thumb

Alert on index=_internal log_level=ERROR grouped by component, and on license usage approaching roughly 80% of quota so you act before a violation window begins.