Deployment Architecture

Issue with Applying Initial shcluster-bundle from Deployer

richcboyer
New Member

I am having an issue where in when I attempt to run the apply shcluster-bundle command, as shown below, I am prompted with the initial warning and then once I have accepted this warning the Splunk CLI closes without providing any error messaging or pushing the contents of the ,,/shcluster/apps/ directory. Can anyone please advice?

splunk apply shcluster-bundle -target https://splrch11.sub.company.com -auth admin:password

To give some context, I am standing up a new search head cluster to replace our existing stand alone search head. I have been able to bootstrap the search head cluster which consists of 3-Instances running on VM instances of Windows Server 2019 Datacenter and a 4th-instance running in the same configuration working as the deployer. These are all freshly established VM instances. These instances are all running v7.3.0 whereas my previous Search Head is running v7.0.0. The instances are all running using the same domain account and admin credentials. The only issue I noted during the configuration of the cluster was initial inability to cluster due to the three Search Head VMs sharing an image causing issues with the GUID which I resolved by performing a clean installation and removing the GUIDs from the instance.cfg file prior to initiating the cluster. I have confirmed the search head instances all have the correct URI configured for the Deployer and that they are all able to ping the deployer. I have also confirmed the clusters are in fact paired using the GUI though I am encountering an issue when attempting to show cluster status from cluster members the Splunk CLI closes without providing any error messaging or messaging of any kind.

0 Karma

dsofoulsdm
New Member

Hi I'm sure you've already solved this but try the following. I saw you were missing the management port.

/opt/splunk/bin/splunk apply shcluster-bundle -target https://splrch11.sub.company.com:8089 -auth admin:password

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...