Monitoring Splunk

Error "Duplicate Servername"

rajeshm
Explorer

Hi

We are getting the following error message while accessing any application.

Unable to distribute to peer named at uri https://<Ip Address:8089 because peer has status = "Duplicate Servername".

Regards

Rajesh

Tags (1)

Prakhar_shukla
Path Finder

did u try disable distribution search ?

0 Karma

khyoung7410
Communicator

enable and disable done.
But there is no difference.

0 Karma

dglinder
Path Finder

A non-Splunk specific cause might be a fat-fingered entry in the systems hosts file, or in the DNS entry for the server name listed in the "at uri" portion of the error message.

0 Karma

khyoung7410
Communicator

I used vmware.
I have installed one server 6.3.10 and 6.4.4.
The configuration is one search header and three indexers.
I finished the configuration and restarted the search header.
Then I searched the search-header below.
- search query : index=_internal source=*splunkd.log log_level=ERROR Distribute
The results below only appear in 6.4.4.
alt text

6.3.10 search header distribute search detail
alt text

0 Karma

Prakhar_shukla
Path Finder

Ok, let me get it clearly.! You have total 3 indexer and 2 search heads. Both are in different version. Do you have any counter master?

0 Karma

Prakhar_shukla
Path Finder

Correction. Cluster master

0 Karma

khyoung7410
Communicator

I have 1 search header and 3 indexer 6.3.10.
Also 1 search header and 3 indexer 6.4.4.
I don't have a cluster master.
alt text

0 Karma

Prakhar_shukla
Path Finder

So its like 1 search head + 3 indexer at 6.3 and a search head + 3 indexer at 6.4.
Total 8 server, 2 different groups. Right?

Please pasted splunk.Log here from server.

0 Karma

Prakhar_shukla
Path Finder

From your previous post figures where you put search head 6.4 that was showing error. I observed indexer are same in both search head. 192.168.88.130 and 192.168.88.131.

0 Karma

Prakhar_shukla
Path Finder

What's current config is like. Please paste all detail like SH names and which connectior is linked with which search head

0 Karma

khyoung7410
Communicator

When I paste the contents of Splunkd.log, the following message is displayed.
"Your comment was submitted, and will be reviewed by a moderator before being visible to all users."

0 Karma

Prakhar_shukla
Path Finder

What's current config is like. Please paste all detail like SH names and which connectior is linked with which search head

0 Karma

khyoung7410
Communicator

05-01-2017 23:48:18.159 +0900 INFO ClusteringMgr - clustering disabled
05-01-2017 23:48:18.159 +0900 INFO SHClusterMgr - initing shpooling with: ht=60 rf=3 ct=60 st=60 rt=60 rct=5 rst=5 rrt=10 rmst=600 rmrt=600 pe=1 im=0 is=0 mor=5 pb=5 rep_port= pptr=10
05-01-2017 23:48:18.159 +0900 INFO SHClusterMgr - shpooling disabled
05-01-2017 23:48:18.159 +0900 INFO PipelineComponent - registering timer callback name=DistributedRestCallerCallback callback=0x7f2709a51590 arg=0x7f2706365080 size=4 aborts=0x0 gen=4 accCbMsecs=0ms
05-01-2017 23:48:18.264 +0900 ERROR DistributedPeer - Peer:https://192.168.88.130:8090 Duplicate Servername
05-01-2017 23:48:18.264 +0900 ERROR DistributedPeer - Peer:https://192.168.88.131:8090 Duplicate Servername
05-01-2017 23:48:18.264 +0900 INFO ServerRoles - Declared role=search_head.
05-01-2017 23:48:18.264 +0900 INFO IndexerInit - running splunkd specific init
05-01-2017 23:48:18.271 +0900 INFO IndexerService - indexes.conf - indexThreads param autotuned to=2
05-01-2017 23:48:18.271 +0900 INFO IndexerService - indexes.conf - memPoolMB param autotuned to=64MB
05-01-2017 23:48:18.271 +0900 INFO MPool - MPool initialized: bytes=67108864

0 Karma

khyoung7410
Communicator

I changed the general stanzas of the three indexers.

Indexer #1 server.conf
[general]
serverName = server_22
pass4SymmKey = $1$tvTHmsS5kq97

Indexer #2 server.conf
[general]
serverName = server_33
pass4SymmKey = $1$oQ/VgulsS5WG

Indexer #3 server.conf
[general]
serverName = server_44
pass4SymmKey = $1$ZjxhnZAKdFJe

My Search Header splunkd.log

05-02-2017 10:05:24.103 +0900 ERROR DistributedPeer - Peer:https://192.168.88.130:8090 Duplicate Servername
05-02-2017 10:05:24.085 +0900 ERROR DistributedPeer - Peer:https://192.168.88.131:8090 Duplicate Servername
05-02-2017 10:05:24.085 +0900 ERROR DistributedPeer - Peer:https://192.168.88.130:8090 Duplicate Servername

Indexers do not show error logs.

0 Karma

khyoung7410
Communicator

05-01-2017 23:48:18.264 +0900 ERROR DistributedPeer - Peer:https://192.168.88.130:8090 Duplicate Servername
05-01-2017 23:48:18.264 +0900 ERROR DistributedPeer - Peer:https://192.168.88.131:8090 Duplicate Servername

0 Karma

Prakhar_shukla
Path Finder

What's current config is like. Please paste all detail like SH names and which indexer is linked with which search head

0 Karma

khyoung7410
Communicator

The log is not strangely attached.

0 Karma

khyoung7410
Communicator

I tried several times, but I can not paste all the logs from splunkd.log.

0 Karma

khyoung7410
Communicator

I compared version 6.3.10 and version 6.4.4.
I installed Splunk and set up distributed search only.
There was no such error in 6.3.10.
"ERROR DistributedPeer - Peer: https: //192.168.88.131: 8090 Duplicate Servername"
However, since using version 6.4.4, this error message has occurred.
Why do I get this message?

0 Karma

Prakhar_shukla
Path Finder

Hi khyoung7410,
what is the current set up of your splunk? where you seeing this error and is it for an indexer?
check the setting> distributed search> search peer detail and server.conf

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...