Datamodel replication issue in SHC

[Nawab]

I have a SHC of 3 search heads. I changed some fields in data model of 1 sh. it is replicated on 2nd SH, but 3rd SH does not have the same fields. Even though that SH was the captian.

I ran resync command but still the same issue.

[Nawab]

I edited the datamodel using web UI, also I just edited a macro and it is reflected in the cluster

[PickleRick]

Ok. This might call for some more troubleshooting but what I'd check

1. Whether the contents of the etc/apps are the same on all nodes.

2. What is the status of the shcluster.

3. If it's always the same sh that is not in sync? And if it's "both ways" out of sync - changes on other shs are not replicated to this one and changes on this one are not replicated to other ones.

Check the connectivity within the cluster, check logs.

[Nawab]

I have just added a field in datamodel which i need to use in my searches. this field is duplicated in 2 SHs but in 1 SH that field is not available.

Cluster health is Okay, and if I change any thing on dashboards or corelation search it is reflected in all SHs

[PickleRick]

OK. How did you edit the datamodel? Normally from the WebUI? Or did you fiddle with the jsons directly?

[PickleRick]

Ok. Do you mean that you redefined the Datamodel itself or just changed the acceleratio  parameters? And are you talking about the dataset definitions or the summarized data in context of it being not in sync?

How did you modify those configurations?

Do you have the same settings defines within an app pushed from the deployer?

[Nawab]

I dont think this is related to my case. if change is replicated with in 2 SH, why changes are not replicated on 1 SH, all 3 SH are sending logs to indexers

[isoutamo]

Have you check that your SHC is healthy and there is no issues e.g. with kvstore or other replications? Easiest this can do with MC or if you haven’t set it up, then you can do those by queries from internal indexes, rest api and cli.

[Nawab]

yes, sh is sending logs to indexers

[gcusello]

Hi @,

please see this:

https://docs.splunk.com/Documentation/Splunk/9.3.2/Indexer/Clustersandsummaryreplication

Ciao.

Giuseppe

[gcusello]

Hi @Nawab ,

did you configured your SHs to send logs to the Indexers?

Ciao.

Giuseppe