Deployment Architecture

Manually rebalancing primaries on indexer cluster fails... why?

lguinn2
Legend

I used

https://myHost:8089/services/cluster/master/control/control/rebalance_primaries

as described in the manual at How primary rebalancing works
myHost is a functioning Cluster Master; it is not in maintenance mode and it is both valid and complete. There are no pending fixup tasks. It is running:
Splunk Version 6.5.1
Splunk Build f74036626f0c

and I got this result:

<response>
    <messages>
        <msg type="ERROR">
             handler=clustermastercontrol method expected=POST does not match actual=GET customaction=rebalance_primaries
        </msg>
    </messages>
</response>

What did I do wrong? Thanks!

0 Karma
1 Solution

Masa
Splunk Employee
Splunk Employee

(ref: http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Rebalancethecluster )

The returned error message indicates you need a POST request.

curl -k -u admin:pass --request POST \
  https://localhost:8089/services/cluster/master/control/control/rebalance_primaries

Hope this works.

View solution in original post

0 Karma

lguinn2
Legend

Lesson learned: Both the rest command in Splunk (from the master node)

| rest /services/cluster/master/control/control/rebalance_primaries splunk_server=local

and the browser interface use an HTTP GET. This is great for retrieving info, but doesn't work for triggering the rebalancing action.

0 Karma

Masa
Splunk Employee
Splunk Employee

(ref: http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Rebalancethecluster )

The returned error message indicates you need a POST request.

curl -k -u admin:pass --request POST \
  https://localhost:8089/services/cluster/master/control/control/rebalance_primaries

Hope this works.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...