- Splunk Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Search head cluster hybrid search: Why error "Gave...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to migrate to a fully clustered environment so I'm trying out hybrid search as a bridge to getting fully clustered.
5x Search head cluster 6.2.1
6x Dist search index members 6.2.1
1x Index cluster master 6.2.1
1x Cluster peers 6.2.1
When performing a search on a search head I get
02-24-2015 14:39:08.539 +1100 WARN ISplunkDispatch - Gave up waiting for the captain to establish a common bundle version across all search peers; using most recent bundles on all peers instead
This also results in a large pause while this times out.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ok Solved. This error seems occurs when the search head captain can not contact the cluster master.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ok Solved. This error seems occurs when the search head captain can not contact the cluster master.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Would appreciate if you could mention how you arrived at this conclusion or what steps did you follow to rectify the error
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
lol its been more than 5 years! 😉
Network connectivity between the new hosts on new (at the time) ports wasn't fully enabled as such the communication between members and the cluster master did not work.
If you see this error now (in the year 2020) this can be caused by other different issues such as the bundle being too large.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@Lucas_K wrote:lol its been more than 5 years! 😉
Network connectivity between the new hosts on new (at the time) ports wasn't fully enabled as such the communication between members and the cluster master did not work.
If you see this error now (in the year 2020) this can be caused by other different issues such as the bundle being too large.
Just here to give you +1 Karma for answering a question FIVE YEARS LATER. and then elaborating on it for the applicability of the current year (2020). your +1 karma is 2yrs late.. I got here as fast as I could
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Actually I think I know what this issue is. The captain must be having trouble getting the peer list from the cluster master. As such it can't know which search peers it needs to send the shc bundles to.
I will check tomorrow 🙂
Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...
Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...
Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...
