Deployment Architecture

Manually rebalancing primaries on indexer cluster fails... why?

lguinn2
Legend

I used

https://myHost:8089/services/cluster/master/control/control/rebalance_primaries

as described in the manual at How primary rebalancing works
myHost is a functioning Cluster Master; it is not in maintenance mode and it is both valid and complete. There are no pending fixup tasks. It is running:
Splunk Version 6.5.1
Splunk Build f74036626f0c

and I got this result:

<response>
    <messages>
        <msg type="ERROR">
             handler=clustermastercontrol method expected=POST does not match actual=GET customaction=rebalance_primaries
        </msg>
    </messages>
</response>

What did I do wrong? Thanks!

0 Karma
1 Solution

Masa
Splunk Employee
Splunk Employee

(ref: http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Rebalancethecluster )

The returned error message indicates you need a POST request.

curl -k -u admin:pass --request POST \
  https://localhost:8089/services/cluster/master/control/control/rebalance_primaries

Hope this works.

View solution in original post

0 Karma

lguinn2
Legend

Lesson learned: Both the rest command in Splunk (from the master node)

| rest /services/cluster/master/control/control/rebalance_primaries splunk_server=local

and the browser interface use an HTTP GET. This is great for retrieving info, but doesn't work for triggering the rebalancing action.

0 Karma

Masa
Splunk Employee
Splunk Employee

(ref: http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Rebalancethecluster )

The returned error message indicates you need a POST request.

curl -k -u admin:pass --request POST \
  https://localhost:8089/services/cluster/master/control/control/rebalance_primaries

Hope this works.

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...