Deployment Architecture

Help with changing IP address on one of the Search Heads in Cluster

Crashfry
Path Finder

Due to infrastructure issues, I need to make a change to the IP address to one of my Search Heads (one of the Search Heads in the cluster ( total of 2 - 1 in each location ).

What changes would need to occur to make this work? From a config stand point, everything points to the deployment server and cluster master for their configurations.

Would anything have to change in terms of configurations? I can't seem to find anything that points specifically to the IP address of the search head.

0 Karma
1 Solution

Crashfry
Path Finder

This was resolved, review the configurations in our search cluster and had to make sure that all configurations were name based and where the IP was referenced - make that change. Also once completed, make sure deployment apps are still on the server or redeploy from the deployment server. Make sure to add the new search head into the cluster for monitoring as well.

View solution in original post

0 Karma

Crashfry
Path Finder

This was resolved, review the configurations in our search cluster and had to make sure that all configurations were name based and where the IP was referenced - make that change. Also once completed, make sure deployment apps are still on the server or redeploy from the deployment server. Make sure to add the new search head into the cluster for monitoring as well.

0 Karma

jaxjohnny2000
Builder

I see this is kind of an old post, but we are running across the same situation.   But rather, we need to change from using an IP address to using hostnames, so that we can change subnets.  

First, I go into the server.conf file and change the mgmt_uri 

from: mgmt_uri = https://10.16.6.53:8089

to: mgmt_uri = https://servername.domainname.com:8089

Then restart splunk

then run: splunk show shcluster-status

I get this:

Encountered some errors while trying to obtain shcluster status.
This node is not part of any cluster configuration, please re-run the command from an active cluster member. Also see "splunk add shcluster-member" to add this member to an existing cluster or see "splunk bootstrap shcluster-captain" to bootstrap a new cluster with this member.

If it go through these steps of (set static captain, remove member, rename mgmt_uri, enable cluster using hostnames, add member), the cluster will come back up, but then I get "error resolving hostname" on the SH Deployer

 

 

0 Karma

sudosplunk
Motivator

To my knowledge, as long as pass4SymmKey doesn't change, communication between search heads to deployer and search heads to indexers should not be impacted.

Crashfry
Path Finder

Which is all that I came across finding when going through configurations again and knowing they communicate using the key across them for binding them - outside of that i could not find anything else - just seemed almost too easy?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...