https://community.splunk.com/t5/Getting-Data-In/Problem-with-Indexer-Discovery-Receiving-quot-ERROR/m-p/229441#M44635 <P>Hi, </P> <P>We have index clustering working fine. We have several heavy forwarders configured successfully with indexer discovery. However, when I go to add another new forwarder, I get the issue below. My steps are to add the clear text pass phrase in the outputs.conf of the forwarder. Then I restart the forwarder. From there Splunk encrypts to what is below (pass4SymmKey). Is this the correct way to add discovery to a forwarder?</P> <PRE><CODE>[tcpout:default-autolb-group] indexerDiscovery = cluster useACK = true [indexer_discovery:cluster] master_uri = <A href="https://cluster_master:8089" target="test_blank">https://cluster_master:8089</A> pass4SymmKey = $1$19GA9JbHEqO/13Z8+c4/2Q== 10-04-2016 13:16:50.955 -0400 ERROR IndexerDiscoveryHeartbeatThread - failed heartbeat for group=default-autolb-group uri=https://cluster_master:8089/services/indexer_discovery http_response=Unauthorized 10-04-2016 13:16:52.066 -0400 WARN TcpOutputProc - Forwarding to indexer group default-autolb-group blocked for 810 seconds. </CODE></PRE> Tue, 04 Oct 2016 17:24:58 GMT brdr 2016-10-04T17:24:58Z https://community.splunk.com/t5/Getting-Data-In/Problem-with-Indexer-Discovery-Receiving-quot-ERROR/m-p/229441#M44635 <P>Hi, </P> <P>We have index clustering working fine. We have several heavy forwarders configured successfully with indexer discovery. However, when I go to add another new forwarder, I get the issue below. My steps are to add the clear text pass phrase in the outputs.conf of the forwarder. Then I restart the forwarder. From there Splunk encrypts to what is below (pass4SymmKey). Is this the correct way to add discovery to a forwarder?</P> <PRE><CODE>[tcpout:default-autolb-group] indexerDiscovery = cluster useACK = true [indexer_discovery:cluster] master_uri = <A href="https://cluster_master:8089" target="test_blank">https://cluster_master:8089</A> pass4SymmKey = $1$19GA9JbHEqO/13Z8+c4/2Q== 10-04-2016 13:16:50.955 -0400 ERROR IndexerDiscoveryHeartbeatThread - failed heartbeat for group=default-autolb-group uri=https://cluster_master:8089/services/indexer_discovery http_response=Unauthorized 10-04-2016 13:16:52.066 -0400 WARN TcpOutputProc - Forwarding to indexer group default-autolb-group blocked for 810 seconds. </CODE></PRE> Tue, 04 Oct 2016 17:24:58 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-with-Indexer-Discovery-Receiving-quot-ERROR/m-p/229441#M44635 brdr 2016-10-04T17:24:58Z https://community.splunk.com/t5/Getting-Data-In/Problem-with-Indexer-Discovery-Receiving-quot-ERROR/m-p/229442#M44636 <P>Hello</P> <P>I believe you have encountered a product defect that is fixed in 6.5.0, 6.4.4 (released last night) and 6.3.7. We have not seen the issue on anything 6.2 and earlier. Documentation is being updated to reflect that this is a fixed issue in 6.5.0.</P> <P>Upgrading to 6.4.4 should fix your issue</P> <P>Thank you</P> Tue, 04 Oct 2016 19:39:56 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-with-Indexer-Discovery-Receiving-quot-ERROR/m-p/229442#M44636 stmcmahon_splun 2016-10-04T19:39:56Z https://community.splunk.com/t5/Getting-Data-In/Problem-with-Indexer-Discovery-Receiving-quot-ERROR/m-p/229443#M44637 <P>Saw this yesterday and, since our Splunk cluster isn't in production yet, I performed the upgrade to 6.5.0 this morning, but still receive the same results. I've double-checked that the pass4SymmKey values match.</P> <P>Any possibility that I would need to upgrade the UF as well?</P> Thu, 06 Oct 2016 17:16:30 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-with-Indexer-Discovery-Receiving-quot-ERROR/m-p/229443#M44637 jmulder 2016-10-06T17:16:30Z