How-To Guides

Instructions for uploading an SCMA file via the Splunk Support Portal:

1. Log in to the Splunk Support Portal.
2. Click the black "Need Help" button in the top-right corner.
3. Click "Upload File".
4. From the drop-down menu, choose "Cloud Assessment" and click the "Submit" button.
5. Drag and drop or browse for the SCMA file.
6. Click the "Submit" button when done.

When the Monitoring Console is not configured to search any indexer clusters, the MC can only search its own local data. In this scenario:

• The SCMA Discovery output will show a very limited instance set.
• Many checks that rely on _internal and _audit data from indexers will return no results or incomplete results.
• The PreFlight check for unconfigured MC instances will flag the missing indexer cluster(s) in red.

Resolution: Configure the MC to use clustered search for the indexer cluster. Refer to Splunk Docs: Configure the MC in distributed mode.

When the MC is correctly configured to search the indexer cluster:

• All cluster members appear in the SCMA Discovery output.
• The Replication Status shows "Successful" for all search peers.
• Checks that search _internal data across indexers return complete results.

The Monitoring Console Overview page will show all instances grouped correctly by role (indexers, search heads, forwarders, etc.).

Attempting to run checks from an MC that is not configured to search any indexer cluster will result in many checks producing no results. The Troubleshooting dashboard will show the affected checks in red (incomplete).

Work with the customer to configure clustered search before proceeding. If configuring clustered search is not possible in the engagement timeframe, document this limitation in the assessment notes and proceed with the data that is available from the MC's local search scope.

This scenario occurs when the instance hosting the SCMA app is not able to search or forward logs to the indexer tier. Symptoms include:

• Searches against index=_internal return no results or only local results.
• The SCMA Discovery output shows the MC as isolated or not forwarding.
• Many checks return empty results or fail entirely.

Diagnostic steps:

1. Verify the MC is forwarding its _internal logs to the indexers by running on the MC:

   index=_internal host=<mc_hostname> | stats count by sourcetype

2. Check outputs.conf on the MC to confirm a forwarding stanza exists and points to a valid indexer or indexer cluster.
3. Check the MC's _internal log for connection errors to the indexers.
4. Verify network connectivity between the MC and the indexers on port 9997 (default).

1. Create an index named scma if this is your first time.
   Navigate to Settings → Indexes → New Index.
2. Export the file using the 4 - Data Export dashboard and save the ZIP to your local computer.
3. Import the file via Splunk data import:
   • Navigate to Settings → Add Data → Upload.
   • Select the exported file and click Next.
   • Set the sourcetype to scma_import.
   • Set the destination index to scma.
   • Click Review then Submit.
4. Validate the import using this search:

   index=scma sourcetype=scma_json

If the SCMA instance is hitting memory limits or timeouts, you can run individual checks on a different, less-loaded Search Head. Follow these steps for searches that do not contain macros:

1. Ensure the search does not contain macros (e.g. do not use | `scma_instance_info(host)`).
2. Navigate to the Troubleshooting dashboard and locate the check that is timing out or being terminated.
3. Open the specific check (e.g. check #54 – indexing_auto_assigned_sourcetypes).
4. Scroll to the bottom of the search and replace the scma_summarize_data("check_name") macro call with the following block, substituting the correct check name and customer name:

   | appendpipe [
     stats count
     | where count=0
     | fields - count
     | eval severity_level=-1,
            signature="This check did not produce results"
   ]
   | eval _time=if(isnull(_time), now(), _time),
          check_name="indexing_auto_assigned_sourcetypes",
          _key="customer_name"
   | eval check_time=_time
   | lookup scma_customer_details _key OUTPUT value AS customer_name
   | eval customer_name=("Customer Name")
   | table *
   | fields - _timediff _tc _key punct
   | collect index=_introspection sourcetype=scma:check

5. Ensure the line | eval customer_name=("Customer Name") contains the exact same customer name as configured in the 1 - Setup dashboard.