Deployment Architecture

Changing/adding the clustering "Secret Key" to an existing cluster.

Ricapar
Communicator

I'm looking for information or suggestions about how to proceed with this.

When configuring a cluster in Splunk, it gives you the option of entering a "Secret Key" on each of the machines that'll be joined in as part of the cluster.

I have two scenarios I'd like some suggestions for, though I think the process might be the same for each:

  1. The cluster was set up without a secret key, and we now want to put one in.
  2. The cluster currently has a secret key set up, but it now needs to be changed to a new one.

What would the best way to approach this be, without disrupting the cluster and the indexing process much?

0 Karma

stath002
Path Finder

I would also be interested if there is a way to decrypt the current secret key. I am trying to add a new SH cluster that points to our singular indexer cluster but don't have the secret keys. Knowing it would be FAAR easier than changing it and it is needed to point the new SH cluster to the indexer cluster

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Decrypting a password or Pass4SymmKey in a conf file is unlikely to ever be possible because it would unravel Splunk's security system. I believe the practice is change the Pass4SymmKey everywhere. It may be painful but it's less painful than the security implications of undoing the Pass4SymmKey.

ppablo
Retired

Hi @Ricapar

The following documentation has subsections following this page that explain how to configure the secret key for a cluster via dashboard, server.conf and CLI.
http://docs.splunk.com/Documentation/Splunk/6.1.2/Indexer/Clusterconfigurationoverview

This documentation covers making changes to a cluster configuration, including the secret key and the various ways of doing so as well.
http://docs.splunk.com/Documentation/Splunk/6.1.2/Indexer/Configurethepeers#Change_the_cluster_confi...

Hope this helps!

Patrick

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...