Deployment Architecture

Failed to create a bundles setup with server name 'GUID'.

xisura
Communicator

Hi ,

Im trying to connect the sh cluster to indexer cluster,Im using Splunk Version 7. All the status are ok.
But everytime i will query a search this error shows up

[idx1] [idx2] [idx3] Failed to create a bundles setup with server name 'GUID'. Using peer's local bundles to execute the search, results might not be correct

in splunkd.log it shows

10-01-2017 22:01:43.115 +0800 WARN ISplunkDispatch - Gave up waiting for the captain to establish a common bundle version across all search peers; using most recent bundles on all peers instead

Please enlighten me

Thanks in Advance

0 Karma
1 Solution

xisura
Communicator

This error will show up if one of the sh cluster member doesn't have the same no. of search peers

View solution in original post

xisura
Communicator

This error will show up if one of the sh cluster member doesn't have the same no. of search peers

bandit
Motivator

Thanks for the solution @xisura. In verion 7.0.x the feature to replicate the search peers config to other members of the search cluster didn't work for me so I had to use a script/command line on each search cluster member to add all peers.

# when scripted from a remote host
ssh -n [SEARCH_HEAD] "/opt/splunk/bin/splunk add search-server https://[SEARCH_PEER]:8089 -auth [LOCAL_ADMIN_ACCOUNT]:[LOCAL_ADMIN_PASS] -remoteUsername [REMOTE_USER] -remotePassword [REMOTE_PASS]"

OR

# locally 
/opt/splunk/bin/splunk add search-server https://[SEARCH_PEER]:8089 -auth [LOCAL_ADMIN_ACCOUNT]:[LOCAL_ADMIN_PASS] -remoteUsername [REMOTE_USER] -remotePassword [REMOTE_PASS]
0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...