<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Search head cluster &amp; Indexer cluster error :Unknown error for peer.Search Results might be incomplete &amp; Slave is unable to handle request at this time in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Search-head-cluster-Indexer-cluster-error-Unknown-error-for-peer/m-p/404138#M71761</link>
    <description>&lt;P&gt;Is there any network latency?&lt;/P&gt;</description>
    <pubDate>Fri, 14 Jun 2019 20:14:43 GMT</pubDate>
    <dc:creator>francisco_mota</dc:creator>
    <dc:date>2019-06-14T20:14:43Z</dc:date>
    <item>
      <title>Search head cluster &amp; Indexer cluster error :Unknown error for peer.Search Results might be incomplete &amp; Slave is unable to handle request at this time</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Search-head-cluster-Indexer-cluster-error-Unknown-error-for-peer/m-p/404137#M71760</link>
      <description>&lt;P&gt;Hi folks,&lt;BR /&gt;
I'm trying to troubleshoot couple of production issues, one related to SHC and other related Indexer clustering.&lt;BR /&gt;
Would be helpful to get any solution to solve them,&lt;/P&gt;

&lt;P&gt;Background: A Splunk standalone system has less data but extremely high number of concurrent / real-time searches. The searches themselves are fast-performing. &lt;BR /&gt;
It was migrated first to (A) 1 Indexer + 3 SH's Cluster setup. It was then attempted to subsequently migrate to (B) 2 Indexers Cluster + 3 SH's Cluster setup.&lt;/P&gt;

&lt;P&gt;Issue #1: &lt;BR /&gt;
- SH dashboards showing error: “Unknown error for peer xx.xx.xx.xxx . Search Results might be incomplete. If this occurs frequently, please check on the peer.” &lt;BR /&gt;
- This seems to correspond to Indexer errors:  “WARN HttpListener - Socket error from xx.xx.xx.xxx.”&lt;/P&gt;

&lt;P&gt;Issue #2: Unable to migrate to Indexer cluster setup (B), since error is shown:  “ Slave is unable to handle request at this time.  This means either slave unable to communicate w/ master OR master does not have  peers added to the cluster.  Check master dashboard and/or master_uri/secret settings.”&lt;/P&gt;

&lt;P&gt;Could anyone help to resolve ? Thanks much in advance.&lt;/P&gt;</description>
      <pubDate>Wed, 10 Apr 2019 09:27:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Search-head-cluster-Indexer-cluster-error-Unknown-error-for-peer/m-p/404137#M71760</guid>
      <dc:creator>premforsplunk</dc:creator>
      <dc:date>2019-04-10T09:27:00Z</dc:date>
    </item>
    <item>
      <title>Re: Search head cluster &amp; Indexer cluster error :Unknown error for peer.Search Results might be incomplete &amp; Slave is unable to handle request at this time</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Search-head-cluster-Indexer-cluster-error-Unknown-error-for-peer/m-p/404138#M71761</link>
      <description>&lt;P&gt;Is there any network latency?&lt;/P&gt;</description>
      <pubDate>Fri, 14 Jun 2019 20:14:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Search-head-cluster-Indexer-cluster-error-Unknown-error-for-peer/m-p/404138#M71761</guid>
      <dc:creator>francisco_mota</dc:creator>
      <dc:date>2019-06-14T20:14:43Z</dc:date>
    </item>
  </channel>
</rss>

