topic Re: Error "Duplicate Servername" in Monitoring Splunk

Error "Duplicate Servername"

rajeshm — Wed, 12 Dec 2012 12:22:53 GMT

We are getting the following error message while accessing any application.

Unable to distribute to peer named at uri https://<Ip Address:8089 because peer has status = "Duplicate Servername".

Regards

Rajesh

Re: Error "Duplicate Servername"

Drainy — Wed, 12 Dec 2012 12:29:12 GMT

It means that you have a search peer (configured in Manager -> Distributed Search) which has the same servername as the search head you're on. Pretty self explanatory 🙂

The usual culprit for these is when you are running two splunk instances on the same box for dev or testing, in this case Splunk will use the server host as its servername by default, you can override this in server.conf in $SPLUNK_HOME/etc/system/local/ by setting a value called servername as per the docs;

[general]
serverName = <ascii string>
    * The name used to identify this Splunk instance for features such as distributed search.
    * Defaults to <hostname>-<user running splunk>.
    * May not be an empty string
    * May contain environment variables
    * After any environment variables have been expanded, the server name (if not an IPv6
      address) can only contain letters, numbers, underscores, dots, and dashes; and
      it must start with a letter, number, or an underscore.

E.g. in server.conf in SPLUNK_HOME/etc/system/local/

[general]
    serverName = bobServ

Of course this is just the usual suspect, it could be another instance on another box which happens to have the same servername, perhaps server.conf has been shared and both servers have the same name or something else altogether 🙂

Re: Error "Duplicate Servername"

rajeshm — Thu, 13 Dec 2012 05:23:23 GMT

We have stopped distributed searched option,Now it doesnot shows the "Duplicate Servername" message.

Regards

Rajesh

Re: Error "Duplicate Servername"

dglinder — Tue, 10 Sep 2013 14:26:28 GMT

A non-Splunk specific cause might be a fat-fingered entry in the systems hosts file, or in the DNS entry for the server name listed in the "at uri" portion of the error message.

Re: Error "Duplicate Servername"

khyoung7410 — Mon, 01 May 2017 07:43:41 GMT

I compared version 6.3.10 and version 6.4.4.
I installed Splunk and set up distributed search only.
There was no such error in 6.3.10.
"ERROR DistributedPeer - Peer: https: //192.168.88.131: 8090 Duplicate Servername"
However, since using version 6.4.4, this error message has occurred.
Why do I get this message?

Re: Error "Duplicate Servername"

Prakhar_shukla — Mon, 01 May 2017 07:57:52 GMT

Hi khyoung7410,
what is the current set up of your splunk? where you seeing this error and is it for an indexer?
check the setting> distributed search> search peer detail and server.conf

Re: Error "Duplicate Servername"

khyoung7410 — Tue, 29 Sep 2020 13:54:04 GMT

I installed one search header and three indexers for version 6.3.10 and version version 6.4.4.
I set only distributed search.
After the distributed search setting, the service was restarted in the same way.
"ERROR DistributedPeer - Peer: https: //192.168.88.131: 8090 Duplicate Servername"
"ERROR DistributedPeer - Peer: https: //192.168.88.131: 8090 Duplicate Servername" This message occurred only in 6.4.4.
Search query is index=_internal source=splunkd.log log_level=ERROR component=DistributedPeer
*6.3.10 Search Header's Distributed Search Detail**

6.3.10 Search Header's Server.conf
[sslConfig]
sslKeysfilePassword = $1$bY3vFG44n7ZX

[lmpool:auto_generated_pool_download-trial]
description = auto_generated_pool_download-trial
quota = MAX
slaves = *
stack_id = download-trial

[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
quota = MAX
slaves = *
stack_id = forwarder

[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
quota = MAX
slaves = *
stack_id = free

[general]
pass4SymmKey = $1$OsG7SCt+1ORX
serverName = server_1

Re: Error "Duplicate Servername"

khyoung7410 — Tue, 29 Sep 2020 13:54:06 GMT

6.4.4 Search Header's Distributed Search Detail

Below is the distribute search screen after splunk restart.

6.4.4 Search Header's Server.conf
[general]
serverName = server_1
pass4SymmKey = $1$fYMl0+0F6W+P

[sslConfig]
sslKeysfilePassword = $1$Ks9xj6hDoj2P

[kvstore]
port = 8192

[lmpool:auto_generated_pool_download-trial]
description = auto_generated_pool_download-trial
quota = MAX
slaves = *
stack_id = download-trial

[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
quota = MAX
slaves = *
stack_id = forwarder

[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
quota = MAX
slaves = *
stack_id = free

Re: Error "Duplicate Servername"

khyoung7410 — Tue, 29 Sep 2020 13:54:01 GMT

I used vmware.
I have installed one server 6.3.10 and 6.4.4.
The configuration is one search header and three indexers.
I finished the configuration and restarted the search header.
Then I searched the search-header below.
- search query : index=_internal source=*splunkd.log log_level=ERROR Distribute
The results below only appear in 6.4.4.

6.3.10 search header distribute search detail

Re: Error "Duplicate Servername"

Prakhar_shukla — Mon, 01 May 2017 13:38:39 GMT

Ok, let me get it clearly.! You have total 3 indexer and 2 search heads. Both are in different version. Do you have any counter master?

Re: Error "Duplicate Servername"

Prakhar_shukla — Mon, 01 May 2017 13:46:47 GMT

Correction. Cluster master

Re: Error "Duplicate Servername"

khyoung7410 — Mon, 01 May 2017 14:04:06 GMT

I have 1 search header and 3 indexer 6.3.10.
Also 1 search header and 3 indexer 6.4.4.
I don't have a cluster master.

Re: Error "Duplicate Servername"

Prakhar_shukla — Mon, 01 May 2017 14:25:28 GMT

So its like 1 search head + 3 indexer at 6.3 and a search head + 3 indexer at 6.4.
Total 8 server, 2 different groups. Right?

Please pasted splunk.Log here from server.

Re: Error "Duplicate Servername"

khyoung7410 — Mon, 01 May 2017 14:53:26 GMT

I tried several times, but I can not paste all the logs from splunkd.log.

Re: Error "Duplicate Servername"

Prakhar_shukla — Mon, 01 May 2017 14:53:35 GMT

From your previous post figures where you put search head 6.4 that was showing error. I observed indexer are same in both search head. 192.168.88.130 and 192.168.88.131.

Re: Error "Duplicate Servername"

Prakhar_shukla — Mon, 01 May 2017 14:55:15 GMT

What's current config is like. Please paste all detail like SH names and which connectior is linked with which search head

Re: Error "Duplicate Servername"

khyoung7410 — Mon, 01 May 2017 15:02:22 GMT

When I paste the contents of Splunkd.log, the following message is displayed.
"Your comment was submitted, and will be reviewed by a moderator before being visible to all users."

Re: Error "Duplicate Servername"

Prakhar_shukla — Mon, 01 May 2017 15:03:38 GMT

What's current config is like. Please paste all detail like SH names and which connectior is linked with which search head

Re: Error "Duplicate Servername"

khyoung7410 — Mon, 01 May 2017 15:24:08 GMT

05-01-2017 23:48:18.264 +0900 ERROR DistributedPeer - Peer:https://192.168.88.130:8090 Duplicate Servername
05-01-2017 23:48:18.264 +0900 ERROR DistributedPeer - Peer:https://192.168.88.131:8090 Duplicate Servername

Re: Error "Duplicate Servername"

khyoung7410 — Mon, 01 May 2017 15:25:21 GMT

The log is not strangely attached.