Deployment Architecture

Search head on Windows can't connect to index cluster master after update from 6.2.1 to 6.3

glentes
Path Finder

Hello community,

I have just updated a standalone search head running on Windows 7 64 Bit from 6.2.1 to 6.3.
The search head is conencted to a 6.2.1 index cluster and I'm getting the following error message

The searchhead is unable to update the peer information. Error = 'failed method=POST path=/services/cluster/master/generation/BB1E749C-349F-45E9-ADB7-0A08CFD13604/?output_mode=json master=indexclustermaster:8089 rv=0 actual_response_code=400 expected_response_code=200 status_line=Bad Request error=No error' for master=https://indexclustermaster:8089.

I removed the following configuration from the local server.conf

[clustering]
master_uri = https://indexclustermaster:8089
mode = searchhead

restarted the search head and used http://localhost:8000 -> settings -> Indexer Clustering -> Enable Indexer Clustering -> choose Search Head Node
to enable the search head again.

After a restart I got the same error again and can'T access any events stored on the index cluster.

From the splund.log:
09-23-2015 13:26:00.196 +0200 WARN CMMasterProxy - Master is down! Make sure pass4SymmKey is matching if master is running.
09-23-2015 13:26:00.196 +0200 ERROR DistributedPeerManager - Unable to connect to the master or received no peer list from the cluster master.'failed method=POST path=/services/cluster/master/generation/BB1E749C-349F-45E9-ADB7-0A08CFD13604/?output_mode=json master=indexclustermaster:8089 rv=0 actual_response_code=400 expected_response_code=200 status_line=Bad Request error=No error' for master=https://indexclustermaster:8089

Looks for me like the pass4SymmKey is not matching anymore after teh update.

Is this problem known? Any suggestion from your side.

Thanks a lot in advance.

Tags (1)
0 Karma
1 Solution

nvanderwalt_spl
Splunk Employee
Splunk Employee

Have you upgraded the cluster master to 6.3 as well? The peer nodes and search heads must run the same or a lower version than the master node.

View solution in original post

glentes
Path Finder

Thank you fast answer and the information.
I just found the compatibility information on page
http://docs.splunk.com/Documentation/Splunk/6.3.0/Indexer/Systemrequirements#Splunk_Enterprise_versi...

0 Karma

nvanderwalt_spl
Splunk Employee
Splunk Employee

Have you upgraded the cluster master to 6.3 as well? The peer nodes and search heads must run the same or a lower version than the master node.

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...