https://community.splunk.com/t5/Deployment-Architecture/SHClustering-one-of-3-Searchheads-is-not-starting-after-apps/m-p/552269#M18827 <P>pushed apps to the search head cluster to 3 Searchheads 2 of them working good but one searched URL is not accessible and cannot run searches.</P><P>The searchhead appeared to be in restarting loop, logs as below;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2278505_restarting.png" style="width: 638px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14225i78BC8CF20FE8E60B/image-dimensions/638x243?v=v2" width="638" height="243" role="button" title="2278505_restarting.png" alt="2278505_restarting.png" /></span></P><P> </P> Wed, 19 May 2021 19:31:46 GMT sylim_splunk 2021-05-19T19:31:46Z https://community.splunk.com/t5/Deployment-Architecture/SHClustering-one-of-3-Searchheads-is-not-starting-after-apps/m-p/552269#M18827 <P>pushed apps to the search head cluster to 3 Searchheads 2 of them working good but one searched URL is not accessible and cannot run searches.</P><P>The searchhead appeared to be in restarting loop, logs as below;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2278505_restarting.png" style="width: 638px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14225i78BC8CF20FE8E60B/image-dimensions/638x243?v=v2" width="638" height="243" role="button" title="2278505_restarting.png" alt="2278505_restarting.png" /></span></P><P> </P> Wed, 19 May 2021 19:31:46 GMT https://community.splunk.com/t5/Deployment-Architecture/SHClustering-one-of-3-Searchheads-is-not-starting-after-apps/m-p/552269#M18827 sylim_splunk 2021-05-19T19:31:46Z https://community.splunk.com/t5/Deployment-Architecture/SHClustering-one-of-3-Searchheads-is-not-starting-after-apps/m-p/552271#M18828 <P>This turned out to happen on a Searchhead repurposed from a searver previously used as an indexer.</P><P>It had "slave-apps" under $SPLUNK_HOME/etc. After removing the directory it stays up and running.</P><P>If you have the same symptoms and find the same log message as above, then worth checking the directory.</P> Wed, 19 May 2021 19:35:48 GMT https://community.splunk.com/t5/Deployment-Architecture/SHClustering-one-of-3-Searchheads-is-not-starting-after-apps/m-p/552271#M18828 sylim_splunk 2021-05-19T19:35:48Z