Deployment Architecture

Failed to create a bundles setup with server name 'GUID'.

xisura
Communicator

Hi ,

Im trying to connect the sh cluster to indexer cluster,Im using Splunk Version 7. All the status are ok.
But everytime i will query a search this error shows up

[idx1] [idx2] [idx3] Failed to create a bundles setup with server name 'GUID'. Using peer's local bundles to execute the search, results might not be correct

in splunkd.log it shows

10-01-2017 22:01:43.115 +0800 WARN ISplunkDispatch - Gave up waiting for the captain to establish a common bundle version across all search peers; using most recent bundles on all peers instead

Please enlighten me

Thanks in Advance

0 Karma
1 Solution

xisura
Communicator

This error will show up if one of the sh cluster member doesn't have the same no. of search peers

View solution in original post

xisura
Communicator

This error will show up if one of the sh cluster member doesn't have the same no. of search peers

bandit
Motivator

Thanks for the solution @xisura. In verion 7.0.x the feature to replicate the search peers config to other members of the search cluster didn't work for me so I had to use a script/command line on each search cluster member to add all peers.

# when scripted from a remote host
ssh -n [SEARCH_HEAD] "/opt/splunk/bin/splunk add search-server https://[SEARCH_PEER]:8089 -auth [LOCAL_ADMIN_ACCOUNT]:[LOCAL_ADMIN_PASS] -remoteUsername [REMOTE_USER] -remotePassword [REMOTE_PASS]"

OR

# locally 
/opt/splunk/bin/splunk add search-server https://[SEARCH_PEER]:8089 -auth [LOCAL_ADMIN_ACCOUNT]:[LOCAL_ADMIN_PASS] -remoteUsername [REMOTE_USER] -remotePassword [REMOTE_PASS]
0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...