https://community.splunk.com/t5/Getting-Data-In/After-deploying-a-search-head-clustering-why-is-authentication/m-p/276446#M52998 <P>Hello,</P> <P>I had found solution these problem, pass4SymmKey should be the same for shcluter and indexer cluster</P> Wed, 11 May 2016 08:13:10 GMT slawny86 2016-05-11T08:13:10Z https://community.splunk.com/t5/Getting-Data-In/After-deploying-a-search-head-clustering-why-is-authentication/m-p/276441#M52993 <P>After deploying a search head cluster, I have a problem with searching anything. SHcluster status is up, but when I logged on each shcluster members, I've noticed in "Distributed environment" -&gt; "Distributed search" -&gt; "Search peers" that authentication to my two indexers failed. In server.conf on each member, pass4SymmKey in [general] stanza and [shclustering] stanza is the same. Has anyone had a similar problem? </P> Tue, 09 Feb 2016 09:05:25 GMT https://community.splunk.com/t5/Getting-Data-In/After-deploying-a-search-head-clustering-why-is-authentication/m-p/276441#M52993 slawny86 2016-02-09T09:05:25Z https://community.splunk.com/t5/Getting-Data-In/After-deploying-a-search-head-clustering-why-is-authentication/m-p/276442#M52994 <P>Are your indexers also in a cluster?</P> Wed, 10 Feb 2016 00:09:31 GMT https://community.splunk.com/t5/Getting-Data-In/After-deploying-a-search-head-clustering-why-is-authentication/m-p/276442#M52994 sk314 2016-02-10T00:09:31Z https://community.splunk.com/t5/Getting-Data-In/After-deploying-a-search-head-clustering-why-is-authentication/m-p/276443#M52995 <P>Have you followed the procedure listed here? <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.7/DistSearch/Connectclustersearchheadstosearchpeers">http://docs.splunk.com/Documentation/Splunk/6.2.7/DistSearch/Connectclustersearchheadstosearchpeers</A></P> Wed, 10 Feb 2016 00:12:07 GMT https://community.splunk.com/t5/Getting-Data-In/After-deploying-a-search-head-clustering-why-is-authentication/m-p/276443#M52995 sk314 2016-02-10T00:12:07Z https://community.splunk.com/t5/Getting-Data-In/After-deploying-a-search-head-clustering-why-is-authentication/m-p/276444#M52996 <P>Yes, indexers are also in a cluster</P> Wed, 10 Feb 2016 06:59:00 GMT https://community.splunk.com/t5/Getting-Data-In/After-deploying-a-search-head-clustering-why-is-authentication/m-p/276444#M52996 slawny86 2016-02-10T06:59:00Z https://community.splunk.com/t5/Getting-Data-In/After-deploying-a-search-head-clustering-why-is-authentication/m-p/276445#M52997 <P>What error did you get after running the splunk edit cluster-config command on the search heads as descibed here: <A href="http://docs.splunk.com/Documentation/Splunk/6.3.3/DistSearch/SHCandindexercluster">http://docs.splunk.com/Documentation/Splunk/6.3.3/DistSearch/SHCandindexercluster</A></P> Wed, 10 Feb 2016 11:12:07 GMT https://community.splunk.com/t5/Getting-Data-In/After-deploying-a-search-head-clustering-why-is-authentication/m-p/276445#M52997 jplumsdaine22 2016-02-10T11:12:07Z https://community.splunk.com/t5/Getting-Data-In/After-deploying-a-search-head-clustering-why-is-authentication/m-p/276446#M52998 <P>Hello,</P> <P>I had found solution these problem, pass4SymmKey should be the same for shcluter and indexer cluster</P> Wed, 11 May 2016 08:13:10 GMT https://community.splunk.com/t5/Getting-Data-In/After-deploying-a-search-head-clustering-why-is-authentication/m-p/276446#M52998 slawny86 2016-05-11T08:13:10Z https://community.splunk.com/t5/Getting-Data-In/After-deploying-a-search-head-clustering-why-is-authentication/m-p/276447#M52999 <P>and I had to change shcluster's member server name in inputs.conf and server.conf, because were duplicated for some hosts in the cluster. After that the problem disaperaed</P> Wed, 11 May 2016 08:20:44 GMT https://community.splunk.com/t5/Getting-Data-In/After-deploying-a-search-head-clustering-why-is-authentication/m-p/276447#M52999 slawny86 2016-05-11T08:20:44Z