Deployment Architecture

Failed to create a bundles setup with server name 'GUID'.

xisura
Communicator

Hi ,

Im trying to connect the sh cluster to indexer cluster,Im using Splunk Version 7. All the status are ok.
But everytime i will query a search this error shows up

[idx1] [idx2] [idx3] Failed to create a bundles setup with server name 'GUID'. Using peer's local bundles to execute the search, results might not be correct

in splunkd.log it shows

10-01-2017 22:01:43.115 +0800 WARN ISplunkDispatch - Gave up waiting for the captain to establish a common bundle version across all search peers; using most recent bundles on all peers instead

Please enlighten me

Thanks in Advance

0 Karma
1 Solution

xisura
Communicator

This error will show up if one of the sh cluster member doesn't have the same no. of search peers

View solution in original post

xisura
Communicator

This error will show up if one of the sh cluster member doesn't have the same no. of search peers

bandit
Motivator

Thanks for the solution @xisura. In verion 7.0.x the feature to replicate the search peers config to other members of the search cluster didn't work for me so I had to use a script/command line on each search cluster member to add all peers.

# when scripted from a remote host
ssh -n [SEARCH_HEAD] "/opt/splunk/bin/splunk add search-server https://[SEARCH_PEER]:8089 -auth [LOCAL_ADMIN_ACCOUNT]:[LOCAL_ADMIN_PASS] -remoteUsername [REMOTE_USER] -remotePassword [REMOTE_PASS]"

OR

# locally 
/opt/splunk/bin/splunk add search-server https://[SEARCH_PEER]:8089 -auth [LOCAL_ADMIN_ACCOUNT]:[LOCAL_ADMIN_PASS] -remoteUsername [REMOTE_USER] -remotePassword [REMOTE_PASS]
0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...