topic Captain Skipping Configuration Replication in Splunk Search

Captain Skipping Configuration Replication

rafamss — Sun, 11 Oct 2015 06:10:18 GMT

Hi guys,

I'm having a problem with my environment, we have 15 machines, 1 Master, 1 Deploy, 1 Universal Forwarder, 6 Search Head, 5 Indexers. The message below begin to appear in my search heads.

The search head cluster captain (https://server0011:8089) is disconnected; skipping configuration replication

We have replication factor of 1 to 3.

What can be ?

Re: Captain Skipping Configuration Replication

aalanisr26 — Thu, 19 Nov 2015 19:48:37 GMT

we have the same problem did you find a solution?

Re: Captain Skipping Configuration Replication

jeremykampwerth — Tue, 16 Feb 2016 22:29:56 GMT

We are experiencing this issue. Any solution?

Re: Captain Skipping Configuration Replication

ben_leung — Tue, 29 Sep 2020 09:26:48 GMT

I would suggest looking at your conf.log for "data.worklog{}.status”=STOP_ON_MISSING_LOCAL_BASELINE

This would tell you if there are potential out of sync nodes from the clusters' captain. I see that these messages automatically disappear. Would that mean the node has dropped its captaincy and after re-synced to the new captains bundle?

Re: Captain Skipping Configuration Replication

jkat54 — Mon, 18 Apr 2016 22:46:11 GMT

This usually happens to me when the cluster master goes down for whatever reason.

Try running 'splunk status' on the captains command line. Then perhaps you'll fine a 'splunk start' is in order.