Deployment Architecture

Search head on Windows can't connect to index cluster master after update from 6.2.1 to 6.3

glentes
Path Finder

Hello community,

I have just updated a standalone search head running on Windows 7 64 Bit from 6.2.1 to 6.3.
The search head is conencted to a 6.2.1 index cluster and I'm getting the following error message

The searchhead is unable to update the peer information. Error = 'failed method=POST path=/services/cluster/master/generation/BB1E749C-349F-45E9-ADB7-0A08CFD13604/?output_mode=json master=indexclustermaster:8089 rv=0 actual_response_code=400 expected_response_code=200 status_line=Bad Request error=No error' for master=https://indexclustermaster:8089.

I removed the following configuration from the local server.conf

[clustering]
master_uri = https://indexclustermaster:8089
mode = searchhead

restarted the search head and used http://localhost:8000 -> settings -> Indexer Clustering -> Enable Indexer Clustering -> choose Search Head Node
to enable the search head again.

After a restart I got the same error again and can'T access any events stored on the index cluster.

From the splund.log:
09-23-2015 13:26:00.196 +0200 WARN CMMasterProxy - Master is down! Make sure pass4SymmKey is matching if master is running.
09-23-2015 13:26:00.196 +0200 ERROR DistributedPeerManager - Unable to connect to the master or received no peer list from the cluster master.'failed method=POST path=/services/cluster/master/generation/BB1E749C-349F-45E9-ADB7-0A08CFD13604/?output_mode=json master=indexclustermaster:8089 rv=0 actual_response_code=400 expected_response_code=200 status_line=Bad Request error=No error' for master=https://indexclustermaster:8089

Looks for me like the pass4SymmKey is not matching anymore after teh update.

Is this problem known? Any suggestion from your side.

Thanks a lot in advance.

Tags (1)
0 Karma
1 Solution

nvanderwalt_spl
Splunk Employee
Splunk Employee

Have you upgraded the cluster master to 6.3 as well? The peer nodes and search heads must run the same or a lower version than the master node.

View solution in original post

glentes
Path Finder

Thank you fast answer and the information.
I just found the compatibility information on page
http://docs.splunk.com/Documentation/Splunk/6.3.0/Indexer/Systemrequirements#Splunk_Enterprise_versi...

0 Karma

nvanderwalt_spl
Splunk Employee
Splunk Employee

Have you upgraded the cluster master to 6.3 as well? The peer nodes and search heads must run the same or a lower version than the master node.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...