Deployment Architecture

Search Head Clustering is not enabled on this node. REST endpoint is not available

Mohsin123
Path Finder

Hi,

Anyone could help ..
Search Head Clustering is not enabled on this node. REST endpoint is not available

We have test env where SH cluster is there. i checked server.conf on each , all attributes are fine .they are connecting to deployer .

But probably i need to do some configuration in deployer because when i try to push an app from deplyoer , it gives the below error :

[ec2-user@ip bin]$ ./splunk show shcluster-status -auth admin:analytics
Search Head Clustering is not enabled on this node. REST endpoint is not available
[ec2-user@bin]$

Tags (1)

mguhad
Communicator

Hi,
You should run all those commands on any of the members, NOT the deployer as you will get the error you are getting. All these commands run from the members (remember the captain does alot of the work here) and NOT the deployer:
splunk show shcluster-status
splunk list shcluster-members
splunk list shcluster-config
splunk rolling-restart shcluster-members

To make sure that you have the SHC members pointing to the right Deployer, run the command:
./bin/splunk list shcluster-config -auth username:password

Once you see the members are pointing to the right Deployer, that means you have set up and ready to push. simply place your untarred apps under /shcluster/apps and push with: splunk apply shcluster-bundle -target https://oneOfmySHs:8089

Check the apps have been deployed to /etc/apps folder on the members and run splunk rolling-restart shcluster-members on any peer if they have been downloaded by the peers and not taken affect. I.e when forwarding internal logs to idx layer, the SHC members might recieve app from the deployer but not implement, in that case, kick off a rolling restart.

I hope this helped, i have struggled with similar issues in the past wtih SHCs.

Musa

somesoni2
SplunkTrust
SplunkTrust

Is the cluster working on it's own? Do you get valid and healthy status when you run /opt/splunk/bin/splunk show shcluster-status command (may prompt for admin credentials)?

0 Karma

Mohsin123
Path Finder

Yes , this command gives the same result on deployer :

Search Head Clustering is not enabled on this node. REST endpoint is not available

While in the SHs, it shows the cluster status with captain

0 Karma

vguptadevops
New Member

you are getting this because you are running the right command on the wrong node. deployer just pushes the app on search head nodes , SHC master is one of the search head node, so try to run the command from one of the search head node and it would show up the cluster info if SHC is configured correctly.

Thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...