https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Splunkd-log/m-p/33977#M948 <P>Marlon,</P> <P>I had this same issue. In my case, I had multiple splunk instances on the same linux server all working just fine, but bundle replication didn't seem to work. Like your post above, I too had these events in splunkd.log, "WARN DistributedBundleReplicationManager - Server indexer1 does not support distributed bundle exchange, probably because it is an older version. Giving up due to error code 401." etc. </P> <P>All splunk instances are running the same 4.2.1 code, so I'm sure it's not due to an older version.</P> <P>My workaround was to use mounted bundles and turn off bundle replication. </P> <P>So, on each indexer in $SPLUNK_HOME/etc/system/local, I put this in distsearch.conf<BR /> [searchhead:searchhead1]<BR /> mounted_bundles = true<BR /> bundles_location = /opt/shared_bundles/searchhead1</P> <P>Docs are <A href="http://www.splunk.com/base/Documentation/latest/Deploy/Mounttheknowledgebundle" target="_blank">here.</A></P> Mon, 28 Sep 2020 09:38:46 GMT jfolkers 2020-09-28T09:38:46Z https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Splunkd-log/m-p/33976#M947 <P>Hi,</P> <P>I'm always getting these error logs on my search head splunkd.log.</P> <P>01-27-2011 12:01:31.398 WARN DistributedBundleReplicationManager - Unable to login to remote peer at <A href="http://10.163.97.13:8089" rel="nofollow">http://10.163.97.13:8089</A> named SILAPD03 with username splunk-system-user 01-27-2011 12:01:36.402 WARN DistributedBundleReplicationManager - Server SILAPD03[http://10.163.97.13:8089] does not support distributed bundle exchange, probably because it is an older version. Giving up due to error code 401. 01-27-2011 12:01:36.402 ERROR DistributedBundleReplicationManager - Unable to get remote checksum from peer named SILAPD03 with uri=http://10.163.97.13:8089 01-27-2011 12:01:36.808 INFO TPool - All 1 workers of BundleReplThreadPool terminated 01-27-2011 12:01:36.808 WARN DistributedBundleReplicationManager - bundle replication to 3 peer(s) took too long (35759ms), bundle file size=5970KB</P> <P>Many times have I changed my password I'm always getting unable to login...</P> <P>Please help!</P> <P>Regards, Marlon</P> Thu, 27 Jan 2011 12:10:25 GMT https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Splunkd-log/m-p/33976#M947 mldaplin 2011-01-27T12:10:25Z https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Splunkd-log/m-p/33977#M948 <P>Marlon,</P> <P>I had this same issue. In my case, I had multiple splunk instances on the same linux server all working just fine, but bundle replication didn't seem to work. Like your post above, I too had these events in splunkd.log, "WARN DistributedBundleReplicationManager - Server indexer1 does not support distributed bundle exchange, probably because it is an older version. Giving up due to error code 401." etc. </P> <P>All splunk instances are running the same 4.2.1 code, so I'm sure it's not due to an older version.</P> <P>My workaround was to use mounted bundles and turn off bundle replication. </P> <P>So, on each indexer in $SPLUNK_HOME/etc/system/local, I put this in distsearch.conf<BR /> [searchhead:searchhead1]<BR /> mounted_bundles = true<BR /> bundles_location = /opt/shared_bundles/searchhead1</P> <P>Docs are <A href="http://www.splunk.com/base/Documentation/latest/Deploy/Mounttheknowledgebundle" target="_blank">here.</A></P> Mon, 28 Sep 2020 09:38:46 GMT https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Splunkd-log/m-p/33977#M948 jfolkers 2020-09-28T09:38:46Z https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Splunkd-log/m-p/33978#M949 <P>I'm having the same problems unfortunately, and can't use a solution with mounted bundles <span class="lia-unicode-emoji" title=":confused_face:">😕</span></P> Fri, 24 Feb 2012 14:21:45 GMT https://community.splunk.com/t5/Deployment-Architecture/Search-Head-Splunkd-log/m-p/33978#M949 Ayn 2012-02-24T14:21:45Z