Deployment Architecture

Search Head Cluster Node fall in a restarting loop

nayuki
New Member

I deploy a Splunk Index Cluster, like following

  • 10.6.113.25 (peer node)
  • 10.6.113.26 (master node)
  • 10.6.113.27 (peer node)
  • 10.6.113.28 (peer node)

And I want to deploy Search Head Cluster in same cluster.

  • 10.6.113.25 (search head)
  • 10.6.113.27 (search head)
  • 10.6.113.28 (search head)
  • 10.6.113.32 (deployer)

I follow the doc: Deploy a search head cluster

Run splunk init shcluster-config in 25,27,28 and restart. But they fall in a restarting loop.

system/local/server.confin node 25

[clustering]
master_uri = https://10.6.113.26:8089
mode = slave
pass4SymmKey = $7$8BS4L6+X6dBUlQusZWdHNLNRkc7QurRQQnV3E9zG5YpWC5kAUj8=

[replication_port://34567]

[shclustering]
conf_deploy_fetch_url = https://10.6.112.32:8089
disabled = 0
mgmt_uri = https://10.6.113.25:8089
pass4SymmKey = $7$JN1I+/uq0kBl7+/fZZWOVKNO7LopWArjBLS7q4e1KO+sHlRb3pbNu28DsVoytuk=
replication_factor = 2
shcluster_label = shcluster1

And when restart, splunkd.log has 03-26-2019 14:05:41.395 +0800 INFO loader - Downloaded new baseline configuration; restarting ...

I'm not sure a node can be both Search Head Cluster node and Indexer Cluster node.

0 Karma

somesoni2
Revered Legend

They can't be a SHC member and IDX cluster member.

0 Karma

nayuki
New Member

I see [replication_port://<port>] in server.conf, and find that both index cluster and search head cluster use same config port. I think it may confilct.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...