topic Re: How to resolve error "Error pulling configurations from the search head cluster captain"? in Deployment Architecture

How to resolve error "Error pulling configurations from the search head cluster captain"?

mintughosh — Fri, 28 Apr 2017 11:24:14 GMT

I am getting the error "Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member"

I tried to run the following command

# splunk resync shcluster-replicated-config

but i am getting the error "Cannot resync_destructive: this instance is the captain"

I then tried to perform the rolling restart among search head cluster, run the following command

# splunk rolling-restart shcluster-members

But still I am getting the error "Error pulling configurations from the search head cluster captain"
I also ran splunk resync shcluster-replicated-config after rolling-restart.
But still not fix. and I am getting above errors

Please suggest a fix

Re: How to resolve error "Error pulling configurations from the search head cluster captain"?

dineshraj9 — Fri, 28 Apr 2017 12:01:50 GMT

Try transferring captain to another node and then perform resync.

https://docs.splunk.com/Documentation/Splunk/6.5.3/DistSearch/Transfercaptain#Change_the_captain

If this doesn't work, then restart the captain node and check.

Re: How to resolve error "Error pulling configurations from the search head cluster captain"?

mintughosh — Fri, 28 Apr 2017 12:08:09 GMT

I am not getting the error now. I followed the below given action -

stop the splunk on captain.
deleted the files and directories under splunk/var/run/ after taking backup
started the splunk on the search head.
ran the resync command.

I have performed the above action 1 hour from now. I have not received any error as of now.

Re: How to resolve error "Error pulling configurations from the search head cluster captain"?

bandit — Fri, 09 Nov 2018 20:15:03 GMT

Running Splunk 7.1.1

the manual/destructive resync on the cluster member having the error corrected the issue for our cluster.

splunk resync shcluster-replicated-config

Re: How to resolve error "Error pulling configurations from the search head cluster captain"?

ktwingstrom — Thu, 02 May 2019 16:47:51 GMT

This worked for me! Thanks!

Re: How to resolve error "Error pulling configurations from the search head cluster captain"?

joesrepsolc — Mon, 18 Nov 2019 17:22:42 GMT

Jut ran into this issue today after a big maintenance window this past week with lots of changes. This worked GREAT. Thank you everyone for the contributions. Awesome stuff!

Re: How to resolve error "Error pulling configurations from the search head cluster captain"?

ridwanahmed — Tue, 25 Feb 2020 16:04:54 GMT

Can someone please explain why this is an issue/ why deleting var/run is the best solution?

Re: How to resolve error "Error pulling configurations from the search head cluster captain"?

ridwanahmed — Tue, 25 Feb 2020 17:39:15 GMT

Found much of this answer reading @lguinn 's comment on https://answers.splunk.com/answers/454262/how-do-i-fix-splunk-resync-shcluster-replicated-co.html

Re: How to resolve error "Error pulling configurations from the search head cluster captain"?

linhmai_bne — Tue, 17 Mar 2020 05:35:37 GMT

This worked for me. Tks

Re: How to resolve error "Error pulling configurations from the search head cluster captain"?

mcazacu — Tue, 20 Oct 2020 14:06:04 GMT

Works on one of the members as well. I had a replication issue with one of the members, did the steps outlined here (on the member, not the captain) and it fixed it!

Thanks! @mintughosh ! 🙂