indexer not working after changing cluster configuration

_pravin — Mon, 04 Nov 2024 11:48:20 GMT

Hi,

I am trying to change the indexer configuration from one cluster master to another but in the process of this change the indexer never starts.

The web service log looks like below

bash$ tail -f var/log/splunk/web_service.log 2024-11-01 16:26:18,141 INFO [6724f3196d7f1cd30e7350] _cplogging:216 - [01/Nov/2024:16:26:18] ENGINE Bus EXITED 2024-11-01 16:26:18,141 INFO [6724f3196d7f1cd30e7350] root:168 - ENGINE: Bus EXITED 2024-11-01 16:38:48,635 INFO [6724f608607f04aeca7810] __init__:174 - Using default logging config file: /data/apps/SPLUNK_INDEXER_1/splunk/etc/log.cfg 2024-11-01 16:38:48,636 INFO [6724f608607f04aeca7810] __init__:212 - Setting logger=splunk level=INFO 2024-11-01 16:38:48,636 INFO [6724f608607f04aeca7810] __init__:212 - Setting logger=splunk.appserver level=INFO 2024-11-01 16:38:48,636 INFO [6724f608607f04aeca7810] __init__:212 - Setting logger=splunk.appserver.controllers level=INFO 2024-11-01 16:38:48,636 INFO [6724f608607f04aeca7810] __init__:212 - Setting logger=splunk.appserver.controllers.proxy level=INFO 2024-11-01 16:38:48,636 INFO [6724f608607f04aeca7810] __init__:212 - Setting logger=splunk.appserver.lib level=WARN 2024-11-01 16:38:48,636 INFO [6724f608607f04aeca7810] __init__:212 - Setting logger=splunk.pdfgen level=INFO 2024-11-01 16:38:48,636 INFO [6724f608607f04aeca7810] __init__:212 - Setting logger=splunk.archiver_restoration level=INFO

Now I have even removed the clustering configuration from the server.conf but still the same issue with the Splunk instance.

Any one else face the same issue?

Regards,
Pravin

Re: indexer not working after changing cluster configuration

PickleRick — Mon, 04 Nov 2024 11:53:36 GMT

Web service should be disabled on indexers so it's not unusual.

Check splunkd.log.

Re: indexer not working after changing cluster configuration

_pravin — Mon, 04 Nov 2024 14:50:11 GMT

Hi @PickleRick ,

Thanks for the response. I agree that usually web service would be disabled but we keep the UI so that we can see the changes.

I managed to clean the indexer completely of all the configurations. Then recreate from backup and it worked.

Thanks,

Pravin

topic indexer not working after changing cluster configuration in Splunk Enterprise

indexer not working after changing cluster configuration

Re: indexer not working after changing cluster configuration

Re: indexer not working after changing cluster configuration