topic Re: Search peers / Replication status / Initial in Splunk Search

Search peers / Replication status / Initial

kevinsikora — Wed, 11 Apr 2012 15:58:20 GMT

I'm trying to setup a distributed search. I have successfully added my search peers to the search head already.

The issue I have is when I use the web interface of Splunk, for the search head, I see that a few of my search peers have the (Replication status) of (Initial). I am not sure how to get these to have the status of (Successful).

To view my search peers, I went to the following location:

Manager > Distributed search > Search peers

Does anyone have an idea of I still need to do in order to get these statuses to change?

Re: Search peers / Replication status / Initial

araitz — Wed, 11 Apr 2012 16:57:19 GMT

Need more information. Is there any information in splunkd.log about peer replication? Are there any errors indication a connection or authentication problem?

Re: Search peers / Replication status / Initial

kevinsikora — Wed, 11 Apr 2012 17:17:17 GMT

Restarting Splunk solved this issue. I'm not sure why my other search peers had a successful status right away.

Re: Search peers / Replication status / Initial

gwen — Mon, 06 Nov 2023 12:35:49 GMT

I have the same problem and I'm stuck a bit, can someone help me find some ideas?

in the splunk search head web interface => settings => advance settings => distributed search => search peer => the "replication status" column is in "initial" state when it should be successful

when I perform a health check I get a message that tells me "opportunity to move from search head pooling to search head cluster"

disabling then re-enabling the indexer cluster could be a solution. I'm a little afraid of breaking everything by doing this.

Re: Search peers / Replication status / Initial

gwen — Fri, 10 Nov 2023 14:53:21 GMT

An instance name was incorrect.

Check in slm web -> setting -> console monitoring -> setting-> general setup

#opt/splunk/etc/system/local/input.conf in your search head.

I've changed the name of an instance and I'm doing

#splunk resync shcluster-replicated-config on the search head to which you have changed the name.

The error has disappeared for the moment. I'm currently monitoring the situation to see if the problem returns.