Deployment Architecture

Is it possible to disable splunkd SSL in Search Head Clustering with "enableSplunkdSSL=false"?

kwchang_splunk
Splunk Employee
Splunk Employee

Hello experts,

Can Search Head Clustering work with enableSplunkdSSL = false option?
I tried the following:

on deployer instance.
- "enableSplunkdSSL = false"

on each SHC member instance.
- "enableSplunkdSSL = false"
- conf_deploy_fetch_url : changed https to http
- mgmt_uri : changed https to http

Tried to restart all instances and also repeated init/bootstrap steps of SHC, but failed.

Each search head can start up well and run distributed searches, but when I run the bootstrap shcluster-captain command, I find following entry from the splunkd.log.

   ERROR SHPRaftConsensus - Failed to bootstrap this node as a captain.

And when I set category.SHPRaftConsensus=DEBUG, I can find the following log entries repeatedly in the splunkd.log of all search head instances.

   DEBUG SHPRaftConsensus - Will become candidate in 110661 ms

Any comments would be very appreciated.

Thank you.

0 Karma

mgo
Splunk Employee
Splunk Employee

In addition to the changes to server.conf, you also have to delete $SPLUNK_HOME/splunk/var/run/splunk/_raft on each of your search heads. You can then restart and run "bootstrap shcluster-captain" again.

0 Karma

apfender_splunk
Splunk Employee
Splunk Employee
0 Karma

kwchang_splunk
Splunk Employee
Splunk Employee

Hello Apfender, Thank you for replying.
I think, it looks different problem.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...