Deployment Architecture

Indexer clustering setup with AWS EC2: How to fix error "the peer cannot connect with the master because the master_uri or secret key are wrong or invalid?"

transtrophe
Communicator

I am just starting use of Splunk Enterprise using AWS EC2. I Have 1 Search Head running on a Windows AMI, 1 Master Indexer running on a Debian AMI, and 20 Peer Indexers also running on Debian instances. All of these components are using ver 6.2.2. From the AWS side all of these instances are in the same VPC and subnet. All of the instances also use the same EC2 Security group with the following rule-set:

RDP TCP 3389 75.73.40.247/32
Custom TCP Rule TCP 514 0.0.0.0/0
SSH TCP 22 75.73.40.247/32
Custom TCP Rule TCP 8191 0.0.0.0/0
Custom TCP Rule TCP 8089 0.0.0.0/0
Custom UDP Rule UDP 514 0.0.0.0/0
Custom TCP Rule TCP 8000 0.0.0.0/0
Custom TCP Rule TCP 5900 - 5909 75.73.40.247/32
Custom TCP Rule TCP 9997 0.0.0.0/0
Custom TCP Rule TCP 5800 75.73.40.247/32

I configured the Master with no problem (not surprising) but when attempting to configure the first peer using the private IP of the master, port 8089 for the master port, port 8191 for the replicator port, and the password seed for the symm key, I get a failure message that the peer cannot connect with the master either because the master_uri or the secret key is wrong or invalid.

Don't know if this specific issue has been addressed previously - didn't find any specific prior references to it (but maybe I didn't look hard enough - lol).

Thanks for any insights into what might be going on here.

0 Karma
1 Solution

transtrophe
Communicator

Issue resolved - had the wrong replicator port. Cluster is now up and running.

View solution in original post

0 Karma

transtrophe
Communicator

Issue resolved - had the wrong replicator port. Cluster is now up and running.

0 Karma

transtrophe
Communicator

BTW - this happens whether I use https or http in constructing the uri to the master.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...