Deployment Architecture

Search Head Cluster Node fall in a restarting loop

nayuki
New Member

I deploy a Splunk Index Cluster, like following

  • 10.6.113.25 (peer node)
  • 10.6.113.26 (master node)
  • 10.6.113.27 (peer node)
  • 10.6.113.28 (peer node)

And I want to deploy Search Head Cluster in same cluster.

  • 10.6.113.25 (search head)
  • 10.6.113.27 (search head)
  • 10.6.113.28 (search head)
  • 10.6.113.32 (deployer)

I follow the doc: Deploy a search head cluster

Run splunk init shcluster-config in 25,27,28 and restart. But they fall in a restarting loop.

system/local/server.confin node 25

[clustering]
master_uri = https://10.6.113.26:8089
mode = slave
pass4SymmKey = $7$8BS4L6+X6dBUlQusZWdHNLNRkc7QurRQQnV3E9zG5YpWC5kAUj8=

[replication_port://34567]

[shclustering]
conf_deploy_fetch_url = https://10.6.112.32:8089
disabled = 0
mgmt_uri = https://10.6.113.25:8089
pass4SymmKey = $7$JN1I+/uq0kBl7+/fZZWOVKNO7LopWArjBLS7q4e1KO+sHlRb3pbNu28DsVoytuk=
replication_factor = 2
shcluster_label = shcluster1

And when restart, splunkd.log has 03-26-2019 14:05:41.395 +0800 INFO loader - Downloaded new baseline configuration; restarting ...

I'm not sure a node can be both Search Head Cluster node and Indexer Cluster node.

0 Karma

somesoni2
Revered Legend

They can't be a SHC member and IDX cluster member.

0 Karma

nayuki
New Member

I see [replication_port://<port>] in server.conf, and find that both index cluster and search head cluster use same config port. I think it may confilct.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...