https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-enable-master-node-on-all-indexers/m-p/473387#M7311 <P>This is well documented, but here is the short answer.</P> <P>Assuming you have already set a pass4SymmKey in the [clustering] stanza on the master, these are the commands you want to run on each of the indexers/peers:</P> <PRE><CODE> /opt/splunk/bin/splunk edit cluster-config -mode slave -master_uri <A href="https://xx.xxx.xx.xxx:8089" target="test_blank">https://xx.xxx.xx.xxx:8089</A> -replication_port 9887 -secret your_key_here /opt/splunk/bin/splunk restart </CODE></PRE> <P>Obviously substituting in your master's IP and pass4SymmKey value (in plain text, not the hashed version).</P> <P>However, I don't personally like this method as it leaved behind the secret in the command history. It's more secure to update server.conf and cycle Splunk, but you asked specifically about the CLI method.</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/ConfigurepeerswithCLI">https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/ConfigurepeerswithCLI</A></P> Fri, 17 Apr 2020 15:37:59 GMT codebuilder 2020-04-17T15:37:59Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-enable-master-node-on-all-indexers/m-p/473386#M7310 <P>Hi All ,</P> <P>I am working in cluster environment with 16 prod indexers, and one separate cluster master node.</P> <P>if I run /opt/splunk/bin/splunk list cluster-peers</P> <P>if i run the above command in master node command prompt which showing all indexers in the cluster but if run same command on any of the indexers showing master node not enabled. <BR /> how to enable master node on each indexer . this case came while synch or pairing indexer with master node.</P> <P>How to enable master node on all indexers with command line prompt.</P> Thu, 16 Apr 2020 12:44:00 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-enable-master-node-on-all-indexers/m-p/473386#M7310 90509 2020-04-16T12:44:00Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-enable-master-node-on-all-indexers/m-p/473387#M7311 <P>This is well documented, but here is the short answer.</P> <P>Assuming you have already set a pass4SymmKey in the [clustering] stanza on the master, these are the commands you want to run on each of the indexers/peers:</P> <PRE><CODE> /opt/splunk/bin/splunk edit cluster-config -mode slave -master_uri <A href="https://xx.xxx.xx.xxx:8089" target="test_blank">https://xx.xxx.xx.xxx:8089</A> -replication_port 9887 -secret your_key_here /opt/splunk/bin/splunk restart </CODE></PRE> <P>Obviously substituting in your master's IP and pass4SymmKey value (in plain text, not the hashed version).</P> <P>However, I don't personally like this method as it leaved behind the secret in the command history. It's more secure to update server.conf and cycle Splunk, but you asked specifically about the CLI method.</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/ConfigurepeerswithCLI">https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/ConfigurepeerswithCLI</A></P> Fri, 17 Apr 2020 15:37:59 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-enable-master-node-on-all-indexers/m-p/473387#M7311 codebuilder 2020-04-17T15:37:59Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-enable-master-node-on-all-indexers/m-p/473388#M7312 <P>could you please let me know the reason why it happened . all are in cluster environment with master node if we check from master node to all indexers are in state <STRONG>UP</STRONG> condition but if we check from indexer master node not enabled why this was coming .</P> <P>one more question i would like to ask , if we ping from master node to indexer the data packets are sending but we check from indexer to master node showing "unknown host" , is it bidirectional or single direction....</P> Sat, 18 Apr 2020 11:02:09 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-enable-master-node-on-all-indexers/m-p/473388#M7312 90509 2020-04-18T11:02:09Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-enable-master-node-on-all-indexers/m-p/473389#M7313 <P>If the master shows all peers are "up" then your cluster is healthy.</P> <P>Running "/opt/splunk/bin/splunk list cluster-peers" is <STRONG>only</STRONG> valid from the master, it is not run on the peers.</P> Sat, 18 Apr 2020 16:21:04 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-enable-master-node-on-all-indexers/m-p/473389#M7313 codebuilder 2020-04-18T16:21:04Z