- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have a search head cluster configuration and due to HW issues at one of the SH, had to rebuild and added to the cluster.
Still I can see old search head details from the master node "Indexer clustering" page with old GUID.
I tried to edit cluster by using command splunk edit cluster-master
, but it is showing error as below:
In handler 'clustersearchheadconfig': Searchhead is not enabled on this node
Could you please suggest how to resolve this?
Thanks
Rajeev
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi rejeev,
Try to remove the shcluster member via:
splunk remove shcluster-member
(wait a minute, if nothing happens or an error pops up nevermind, just continue)
Stop splunk afterwards:
splunk stop
Clean the node of any leftover configuration data with:
splunk clean all
Start the node with:
splunk start
Then add the instance again to the existing SH-Cluster:
splunk add shcluster-member -current_member_uri https://URL OF AN EXISTING SH IN THE CLUSTER:8089
The new SH will now request the cluster-configuration from the master.
If this does not work, run:
splunk stop
Go into server.conf
Delete everything under the [shclustering] stanza
splunk restart
Then add the instance again to the existing SH-Cluster:
splunk add shcluster-member -current_member_uri https://URL OF AN EXISTING SH IN THE CLUSTER:8089
Hope this works... let me know if or if not 😉
Best regards
pyro_wood
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi rejeev,
Try to remove the shcluster member via:
splunk remove shcluster-member
(wait a minute, if nothing happens or an error pops up nevermind, just continue)
Stop splunk afterwards:
splunk stop
Clean the node of any leftover configuration data with:
splunk clean all
Start the node with:
splunk start
Then add the instance again to the existing SH-Cluster:
splunk add shcluster-member -current_member_uri https://URL OF AN EXISTING SH IN THE CLUSTER:8089
The new SH will now request the cluster-configuration from the master.
If this does not work, run:
splunk stop
Go into server.conf
Delete everything under the [shclustering] stanza
splunk restart
Then add the instance again to the existing SH-Cluster:
splunk add shcluster-member -current_member_uri https://URL OF AN EXISTING SH IN THE CLUSTER:8089
Hope this works... let me know if or if not 😉
Best regards
pyro_wood
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You want to use the SHC Captain as the argument to "-current_member_uri" otherwise you'll get an error like this one:
Failed to proxy call to member https://my.host.name:8089. ERROR: This node is not the captain and doesn't have a valid captain uri to proxy the call
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for response.
