Deployment Architecture

Error in Pre-deploy check

Nawab
Communicator

I have 3 new splunk enterprise. 2 are acting as search heads and 1 is acting as deployer.

I have successfully made them as a cluster and can even push user and search configs but when i push app or add-ons from deployer i get below error.

 

Error in pre-deploy check, uri=https://x.x.x.x8089/services/shcluster/captain/kvstore-upgrade/status, status=401, error=No error

even the password is correct for deployer which is also same for both SHs.

What could be the issue here

 

PS: I know splunk recommend to use 3 SH and 1 deployer. I tried it as well but have same issue.

Labels (2)
Tags (1)
0 Karma
1 Solution

Nawab
Communicator

I found the solution. 
It was Pass4symmkey issue, I had some special charaters in my pass4symmkey due to which there was a difference is passwords.

to check use below commands.

splunk btool server list shcluster --debug | grep -i pass4symmkey ( this will give you your password on spunk)

splunk show-decrypted --value 'pass4symmkey' (this will decrypt the key)

 

now verify the pass key it will surely be a missmatch.

View solution in original post

Nawab
Communicator

I found the solution. 
It was Pass4symmkey issue, I had some special charaters in my pass4symmkey due to which there was a difference is passwords.

to check use below commands.

splunk btool server list shcluster --debug | grep -i pass4symmkey ( this will give you your password on spunk)

splunk show-decrypted --value 'pass4symmkey' (this will decrypt the key)

 

now verify the pass key it will surely be a missmatch.

splunkreal
Influencer

Hello, thanks for your help, had similar issue due to splunk init shcluster-config, secret key wasn't correctly encrypted in server.conf apparently, as seen with help of splunk show-decrypted

* If this helps, please upvote or accept solution if it solved *
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...