Deployment Architecture

Search head on Windows can't connect to index cluster master after update from 6.2.1 to 6.3

glentes
Path Finder

Hello community,

I have just updated a standalone search head running on Windows 7 64 Bit from 6.2.1 to 6.3.
The search head is conencted to a 6.2.1 index cluster and I'm getting the following error message

The searchhead is unable to update the peer information. Error = 'failed method=POST path=/services/cluster/master/generation/BB1E749C-349F-45E9-ADB7-0A08CFD13604/?output_mode=json master=indexclustermaster:8089 rv=0 actual_response_code=400 expected_response_code=200 status_line=Bad Request error=No error' for master=https://indexclustermaster:8089.

I removed the following configuration from the local server.conf

[clustering]
master_uri = https://indexclustermaster:8089
mode = searchhead

restarted the search head and used http://localhost:8000 -> settings -> Indexer Clustering -> Enable Indexer Clustering -> choose Search Head Node
to enable the search head again.

After a restart I got the same error again and can'T access any events stored on the index cluster.

From the splund.log:
09-23-2015 13:26:00.196 +0200 WARN CMMasterProxy - Master is down! Make sure pass4SymmKey is matching if master is running.
09-23-2015 13:26:00.196 +0200 ERROR DistributedPeerManager - Unable to connect to the master or received no peer list from the cluster master.'failed method=POST path=/services/cluster/master/generation/BB1E749C-349F-45E9-ADB7-0A08CFD13604/?output_mode=json master=indexclustermaster:8089 rv=0 actual_response_code=400 expected_response_code=200 status_line=Bad Request error=No error' for master=https://indexclustermaster:8089

Looks for me like the pass4SymmKey is not matching anymore after teh update.

Is this problem known? Any suggestion from your side.

Thanks a lot in advance.

Tags (1)
0 Karma
1 Solution

nvanderwalt_spl
Splunk Employee
Splunk Employee

Have you upgraded the cluster master to 6.3 as well? The peer nodes and search heads must run the same or a lower version than the master node.

View solution in original post

glentes
Path Finder

Thank you fast answer and the information.
I just found the compatibility information on page
http://docs.splunk.com/Documentation/Splunk/6.3.0/Indexer/Systemrequirements#Splunk_Enterprise_versi...

0 Karma

nvanderwalt_spl
Splunk Employee
Splunk Employee

Have you upgraded the cluster master to 6.3 as well? The peer nodes and search heads must run the same or a lower version than the master node.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...