[SHClustering] one of 3 Searchheads is not starting after apps pushed to the members.

[sylim_splunk]

pushed apps to the search head cluster to 3 Searchheads 2 of them working good but one searched URL is not accessible and cannot run searches.

The searchhead appeared to be in restarting loop, logs as below;

 

[sylim_splunk · Accepted solution]

This turned out to happen on a Searchhead repurposed from a searver previously used as an indexer.

It had "slave-apps" under $SPLUNK_HOME/etc. After removing the directory it stays up and running.

If you have the same symptoms and find the same log message as above, then worth checking the directory.