topic Re: How to push updates from SH deployer and Index Cluster master? in Splunk Enterprise

How to push updates from SH deployer and Index Cluster master?

pfabrizi — Wed, 15 Aug 2018 18:48:48 GMT

I had to update a props.conf and I am trying to push it via my Index cluster master and my sh cluster deployer.

what is the command to push from my index cluster?

when I try pushing from SH cluster deployer I get this error:

Error while deploying apps to target=https://txxxxxxx2:8089 with members=2: No captain found amongst members

I used command ./splunk apply shcluster-bundle -target https://txxxxxx2:8089.

THis worked last week when I pushed a new app.

Thanks!

Re: How to push updates from SH deployer and Index Cluster master?

sudosplunk — Wed, 15 Aug 2018 19:04:01 GMT

The error message means, either your SH cluster captain is down or deployer can't talk to the captain. To see your cluster status, run splunk show shcluster-status. If captain is down or undetermined, you can manually assign a captain and set members list by running below command,
Run on new captain: splunk bootstrap shcluster-captain –servers_list https://SH1:8089, https://SH2:8089

To push configurations to indexers from cluster master:
From $SPLUNK_HOME/bin/, run ./splunk apply cluster-bundle -auth admin:<admin_password>

To push configurations to search heads from deployer:
From $SPLUNK_HOME/bin/, run ./splunk apply shcluster-bundle -target <URI>:<management_port> -auth admin:<admin_password>

More admin CLI commands can be found here.

Re: How to push updates from SH deployer and Index Cluster master?

pfabrizi — Thu, 16 Aug 2018 10:04:58 GMT

so when I run ./splunk show shcluster-status on a member it shows me the members and the captain and the members as up. When I try to run this command on my sh master\deployer it tell me search head master in not enabled.

I can see that my apps are under /opt/splunk/etc/shcluster/apps.

any thoughts?

Thank You!

Re: How to push updates from SH deployer and Index Cluster master?

sudosplunk — Thu, 16 Aug 2018 14:06:49 GMT

Based on your show cluster-status, it looks like you are getting this message because the captain is actually not a member of the cluster. While member2 and member3 are present in the members list, member1 is not.

Additionally, I would specifically target the captain when running apply shcluster-bundle command. i.e. member1(captain), ./splunk apply shcluster-bundle -target https://captain:8089 -auth admin:<admin_password>

Please try a restart of member1 and see if that prompts a re-election and hopefully have member1 join the cluster successfully. Otherwise run this on new captain, splunk bootstrap shcluster-captain –servers_list https://member1:8089, https://member2:8089, https://member3:8089 to manually assign a captain and set members.

Please let me know if this helps!