Deployment Architecture

Search Head Cluster Node fall in a restarting loop

New Member

I deploy a Splunk Index Cluster, like following

  • (peer node)
  • (master node)
  • (peer node)
  • (peer node)

And I want to deploy Search Head Cluster in same cluster.

  • (search head)
  • (search head)
  • (search head)
  • (deployer)

I follow the doc: Deploy a search head cluster

Run splunk init shcluster-config in 25,27,28 and restart. But they fall in a restarting loop.

system/local/server.confin node 25

master_uri =
mode = slave
pass4SymmKey = $7$8BS4L6+X6dBUlQusZWdHNLNRkc7QurRQQnV3E9zG5YpWC5kAUj8=


conf_deploy_fetch_url =
disabled = 0
mgmt_uri =
pass4SymmKey = $7$JN1I+/uq0kBl7+/fZZWOVKNO7LopWArjBLS7q4e1KO+sHlRb3pbNu28DsVoytuk=
replication_factor = 2
shcluster_label = shcluster1

And when restart, splunkd.log has 03-26-2019 14:05:41.395 +0800 INFO loader - Downloaded new baseline configuration; restarting ...

I'm not sure a node can be both Search Head Cluster node and Indexer Cluster node.

0 Karma

Revered Legend

They can't be a SHC member and IDX cluster member.

0 Karma

New Member

I see [replication_port://<port>] in server.conf, and find that both index cluster and search head cluster use same config port. I think it may confilct.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!