topic Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label in Monitoring Splunk

Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

sloshburch — Mon, 17 Jul 2017 14:33:39 GMT

I'm guessing I'm overlooking something obvious here, so reaching out to the community for an extra set of eyes.

I have the label set on the shcluster_label set on the deployer but the "Search Head Cluster(s)" column in the MC Setup never shows the label. As such, I get the warning that "This instance is a search head deployer without a search head cluster label. We recommend you edit this instance to set its search head cluster label."

I even set the shcluster_label in $SPLUNK_HOME/etc/system/local/server.conf. It matches the value on the SHC members. Btool shows it loading correctly. Deployer and SHC members all show site = site0 (as desired).

I even tried the instructions on http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCconfigurationoverview#Set_the_search_head_cluster_label for post setting the label after building the cluster.

Am I overlooking something? Anyone see anything I'm not?

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

woodcock — Mon, 17 Jul 2017 14:37:55 GMT

This is the universe's way of telling you "Seach Head Clustering is bad mojo; turn back now or forever be filled with regret!"

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

mattymo — Mon, 17 Jul 2017 16:41:51 GMT

Have you tried the magic "apply settings/changes" in General Setup of the MC to see if it will take the settings?

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

sloshburch — Mon, 17 Jul 2017 20:45:29 GMT

Oh you silly goose.

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

sloshburch — Mon, 17 Jul 2017 20:46:14 GMT

🙂 It's actually once you apply such config that these messages present themselves. So, yea, I tried that but no luck.

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

sloshburch — Mon, 24 Jul 2017 14:38:54 GMT

I've opened a ticket for this one.

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

rrthokala — Thu, 12 Oct 2017 18:39:29 GMT

What was the solution for this?

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

sloshburch — Wed, 18 Oct 2017 12:29:36 GMT

No update yet. A work effort for the fix is in the queue and I used your query to ask for an update.

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

Robbie1194 — Wed, 31 Oct 2018 09:37:37 GMT

Was a solution ever found for this because I'm getting the exact same issue.

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

sloshburch — Thu, 01 Nov 2018 16:46:48 GMT

Not yet. I'm checking again with the product team 😞

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

ypeng_splunk — Mon, 07 Jan 2019 12:49:22 GMT

Any solution from the ticket?

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

sloshburch — Mon, 07 Jan 2019 13:15:53 GMT

Nothing told to me. But I'll pester again.

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

ypeng_splunk — Mon, 07 Jan 2019 13:19:29 GMT

I remember it was alright when I did the same based on v7.2.0 weeks ago. Today, I got the same issue reported by one of my friends for v7.2.3. Just add more info here. I will built a docker cluster soon to see what's going on.

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

ghantk1 — Tue, 29 Sep 2020 22:35:31 GMT

Most often this is fixed by apply changes and you have proper roles. Check the permissions on assets.csv under $SPLUNK_HOME/etc/apps/splunk_monitoring_console/lookups and also doublecheck to see if the entry for shcluster exists in the assets.csv.

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

jawaharas — Thu, 30 May 2019 00:13:00 GMT

This worked for me.

In the Splunk Monitoring Console app,

Navigate to Settings -> General setup
Click Edit -> Edit Instance on 'SHC Deployer' instance's entry
Enter the Search Head Cluster's label in the pop-up window and save.

Below warning won't appear after that.

"At least one of your instances is a search head deployer without a search head cluster label"

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

sloshburch — Tue, 02 Jul 2019 17:28:18 GMT

What release are you on? It works for me on 7.3 so maybe it's now fixed.

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

jawaharas — Tue, 02 Jul 2019 23:51:17 GMT

We are using 7.1.1

Re: Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

mustapha_arakji — Thu, 09 Mar 2023 00:25:18 GMT

Same issue here. Even after "Apply Changes" still getting the warnings.

I managed to fix it from Monitoring Console > General Setup > Edit > "Disable Monitoring", then "Enable Monitoring" for each search head and the deployer! (make sure to review the roles after you do this step).