Insights Nodes
View enrolled Splunk hosts, their operational state, and fleet details
Insights Nodes
Insights Nodes are lightweight agents running on your Splunk hosts that report operational state, configuration snapshots, and certificate status to the Automation Platform.
Navigation
- Parent: Automation Platform
- Previous: Getting Started with DAP
- Next: Change Plans
- Related: Insights Dashboard
Nodes List
Navigate to Automation Platform → Platform → Splunk Enterprise → Nodes to see all enrolled hosts. The table shows:
| Column | Description |
|---|---|
| Hostname | The host's reported hostname (click to open details) |
| Role | Splunk role detected from collected configuration, or Worker for worker-bootstrap hosts |
| IP Address | Redacted by default — click the eye icon to reveal |
| Splunk | Installed Splunk Enterprise version |
| Agent | Insights Node agent version |
| Last Seen | When the node last checked in |
| Enrolled | Date the node was first enrolled |
Use Refresh to reload the list.
Worker-Bootstrap Hosts
Hosts enrolled via a Worker Node token show a Worker badge instead of a Splunk role. These hosts run the DAP execution worker but do not collect Splunk configuration through an Insights node.
Worker hosts appear on Nodes for connectivity tracking but are excluded from compliance scoring and inputs coverage denominators — they have no configuration snapshots to evaluate. This is expected behavior, not an error.
Node Details
Click any hostname to open the node detail view. You see:
- Host information — hostname, host ID, IP address, architecture, Splunk version, agent version, enrollment date, and last check-in time
- Configuration files — browse every
.conffile on the host, organized by app - Execution history — past change plan executions that targeted this host
- API keys — per-host keys used for node-to-platform authentication
Worker Uninstall and Decommission
On worker-enrolled hosts, the node detail page shows Node Actions with options to manage the bootstrap package:
| Action | What It Does |
|---|---|
| Uninstall worker | Opens a dialog with Uninstall script and Manual commands tabs. Run the snippets on the host via SSH or your config management tool to remove the bootstrap package and worker services. |
| Decommission in Enterprise Admin | Opens Enterprise → Host lifecycle with this host pre-selected for enrollment removal |
The uninstall dialog includes guidance for re-enrollment: host cleanup on the Splunk server does not remove the Observer enrollment record. If a fresh install fails with host_already_enrolled, use Block Node on the node detail page, then ask a platform operator to clear the stale enrollment before re-enrolling with a new token.
For fleet-wide enrollment removal, use Host Lifecycle in Enterprise Admin. Decommission clears the bootstrap enrollment; optionally purge observed inventory (configs, compliance, operational state) when the host should leave the fleet entirely.
IP Address Privacy
IP addresses are masked by default (shown as •••.•••.•••.•••). Click the eye icon next to any host to reveal the address for that row. Click again to re-hide. This protects sensitive network information from shoulder-surfing.
Empty State
If no nodes are enrolled, the page displays a prompt to create an enrollment token. Follow Getting Started with DAP to enroll your first host.
