topic Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer. in Splunk Search

Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer.

splunker12er — Mon, 28 Sep 2020 18:36:08 GMT

WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer.

Possibilities :
relax the primary search criteria -> (index=* doesnt work)
widen the time range of the search ->(time range chosen in 'all time')
check that the default search indexes for your account include the desired indexes -> (admin role -> using default settings)

what could be the cause ?

Splunk version: Splunk 6.0.4 (build 207768)
Role : License master servers
Slaves version: Splunk 6.2.1 (build 245427)

Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer.

MuS — Wed, 07 Jan 2015 08:54:42 GMT

Hi splunker12er,

It is I again 😉

Does your License master, where you run this search, have any search peers configured? Check in the UI

http[s]://YourSplunkHostName:YourSplunkPort/en-GB/manager/search/search/distributed/peers

or by using this REST command on the license master:

| REST /services/search/distributed/peers

cheers, MuS

Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer.

Lucas_K — Thu, 29 Jan 2015 23:19:37 GMT

try putting splunk_server=* into your base search.

I just encountered this on a hunk install.

Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer.

ii_splunk — Tue, 17 Feb 2015 15:53:06 GMT

I think this is a bug that Splunk needs to fix.... here is the work around in case anyone gets this:

On your search head do the following:

Settings->Distributed Management Console
(NOTE: Indexers will have N/A shown)
Setup->Apply Changes->Refresh
(NOTE: No changes were actually made)

Verify fix by clicking "Overview" in Distributed Management Console; Indexers will now show correct indexing rate.

Search as normal; workaround complete.

Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer.

kylekoza — Tue, 17 Feb 2015 18:23:21 GMT

I had the same issue and this fixed it. Thanks!

Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer.

MuS — Tue, 17 Feb 2015 19:08:50 GMT

Hi ii_splunk & kylekoza,

please file a bug report with Splunk Support if this is re-producable http://docs.splunk.com/Documentation/Splunk/6.2.0/Troubleshooting/HowtofileagreatSupportcase
But to be honest - I believe you had some trouble - this question is not related to Distributed management console. DMC is only available since Splunk 6.2 http://docs.splunk.com/Documentation/Splunk/6.2.0/ReleaseNotes/MeetSplunk#Distributed_management_console and @splunker12er is using Splunk 6.0.4

cheers, MuS

Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer.

ii_splunk — Tue, 17 Feb 2015 19:34:57 GMT

I can't reproduce at will but when the cluster get's in this "odd" state; I happened onto this work around. Has reoccured a few times on our cluster.

Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer.

yannK — Mon, 28 Sep 2020 19:35:52 GMT

Here is the known bug SPL-99116

After enabling the Distributed Management Console DMC, in "distributed mode", in an indexing cluster, the search-head may not be able to search all the peers. The error will mention splunk_server_group : "Search filters specified using splunk_server/splunk_server_group do not match any search peer". The workarounds are to go to the DMC setup page and hit "apply". To avoid the issue switch the DMC to "single instance" mode.

http://docs.splunk.com/Documentation/Splunk/6.2.2/ReleaseNotes/KnownIssues#Distributed_search_and_search_head_clustering_issues

Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer.

lycollicott — Thu, 28 Jan 2016 13:30:31 GMT

ii_splunk,
Why and how does that work? It worked for me, but I don't understand it at all.

Settings->Distributed Management
Console (NOTE: Indexers will have N/A
shown) Setup->Apply Changes->Refresh
(NOTE: No changes were actually made)

Verify fix by clicking "Overview" in
Distributed Management Console;
Indexers will now show correct
indexing rate.

Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer.

triest — Fri, 12 Feb 2016 19:31:05 GMT

Of particular note is that this affected all searches.

As far as I know no changes where made to our DMC setup; we noticed that all searches quit working on our cluster master with the above mentioned error message.

Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer.

ridwanahmed — Wed, 24 Oct 2018 17:30:07 GMT

thank you! I had the same ridiculous issue haha

Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer.

openpath_llc — Tue, 14 Apr 2020 16:49:23 GMT

Encountered this same bug on Splunk 8.0.2.1. The steps from @ii_splunk worked well for me also.

Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer.

terminaloutcome — Wed, 03 Jun 2020 07:30:59 GMT

Same, on 8.0.1.

Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match

marcoscala — Mon, 28 Feb 2022 11:09:37 GMT

Same bug on 8.0.8. The workaround proposed worked!!!

Re: Unable to run any search query : WARN: Search filters specified using splunk_server/splunk_server_group do not match

mhoustonludlam_ — Tue, 04 Jun 2024 17:55:25 GMT

Just ran into this "bug" again in V9.1.1. It is now called the Monitoring Console but otherwise the fix is the same.