ES SH Message: "Health Check: Splunk server "idx-i-XXX..splunkcloud.com" does not meet the recommended minimum system requirements.

Applicability

Description

Health Check: Splunk server "idx-i-XXX.<stackid>.splunkcloud.com" does not meet the recommended minimum system requirements.

Investigation

As part of the ES application SplunkEnterpriseSecuritySuite an out of the box Search / Alert is configured to run every 24 hours.

This can be found by accessing the ES SH -> Searches, Reports and Alerts -> modify the filters to all apps and owners -> search for "Audit - ES System Requirements". 

To fully confirm, you can run the following query scoped for the that triggered the alert:

| rest splunk_server=<stack_name> /services/server/info
| fields serverName, numberOfCores, numberOfVirtualCores, physicalMemoryMB
| rename numberOfCores as numberOfPhysicalCores
| eval physicalMemoryGB = round(physicalMemoryMB/1024)
| table serverName, numberOfPhysicalCores, numberOfVirtualCores, physicalMemoryGB

Resolution

For Splunk Cloud deployment, the stack has been provisioned infrastructure as per requirements. Splunk Cloud Ops team are responsible for the infrastructure capacity and sizing. On a virtual system this check will often fail since the number of physical CPU's returned by the REST call in the search is 1. The number of virtual cores, not reflected in the REST call, could be sufficient.

Since the indexers are adequate for the system requirements, therefore, this message is safe to be ignored. To stop the warning messages, Go to Searches, Reports and Alerts -> modify the filters to all apps and owners -> search for "Audit - ES System Requirements", under Actions select Edit -> Disable. 

Please contact Splunk Technical Support should there be questions or concerns regarding performance. 

Related Links

Why does the Splunk App for Enterprise Security trigger audit warnings about system requirements in a virtualized environment?