How do I debug 400 error between Search Head and Peer?

AnotherRandomGu — Fri, 08 Sep 2017 10:33:38 GMT

Hello,
currently I have 3 vms on the same data center same RHEL version and same splunk*.rpm installed on them, one is supposed to act as Master, a SH and an Indexer.

On the SH I get this on the Search Peer list:

The log in question has these interesting lines:
10.74.55.14 - - [08/Sep/2017:11:03:33.150 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms
10.74.55.14 - - [08/Sep/2017:11:03:33.151 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms
10.74.55.14 - - [08/Sep/2017:11:04:33.159 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms
10.74.55.14 - - [08/Sep/2017:11:04:33.160 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms

Here's My SH server.conf:

[general]
serverName = isearchhead
pass4SymmKey = REDACTED


[sslConfig]
sslPassword = REDACTED
enableSplunkdSSL = false
supportSSLV3Only = false
sslVerifyServerCert = false

[lmpool:auto_generated_pool_download-trial]
description = auto_generated_pool_download-trial
quota = MAX
slaves = *
stack_id = download-trial

[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
quota = MAX
slaves = *
stack_id = forwarder

[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
quota = MAX
slaves = *
stack_id = free

[lmpool:auto_generated_pool_enterprise]
description = auto_generated_pool_enterprise
quota = MAX
slaves = *
stack_id = enterprise

[license]
active_group = Enterprise

[clustering]
master_uri = clustermaster:REDACTED:8089
mode = searchhead

[clustermaster:REDACTED:8089]
master_uri = http://REDACTED:8089
multisite = false
pass4SymmKey = REDACTED
site = default
~

And the distsearch.conf:

[distributedSearch]
servers =  https://[Search Peer]:8089/
trySSLFirst = false #this was a shot in the dark for the 5 second thing

[general]
serverName = iindexer1
pass4SymmKey = REDACTED

[sslConfig]
sslPassword = REDACTED
enableSplunkdSSL = false
supportSSLV3Only = false
sslVerifyServerCert = false

[lmpool:auto_generated_pool_download-trial]
description = auto_generated_pool_download-trial
quota = MAX
slaves = *
stack_id = download-trial

[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
quota = MAX
slaves = *
stack_id = forwarder

[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
quota = MAX
slaves = *
stack_id = free

[license]
master_uri = https://[SEARCH HEAD]:8089

[replication_port://9887]

on etc/auth/distServerKeys/isearchhead/trusted.pem of the Search Peer there's the file I pulled from SH according to instructions.

What am I missing here?
Thank you very much.

Re: How do I debug 400 error between Search Head and Peer?

AnotherRandomGu — Fri, 08 Sep 2017 15:23:00 GMT

Changed https to http on distsearch.conf and it worked.
I could swear this hadn't worked earlier.

topic How do I debug 400 error between Search Head and Peer? in Getting Data In

How do I debug 400 error between Search Head and Peer?

Re: How do I debug 400 error between Search Head and Peer?