Deployment Architecture

The searchhead is unable to update the peer information. Error = 'Master has multisite enabled but it is missing the 'multisite' attribute' for master=https://127.0.0.1:8990

jackiewkc
Path Finder

Does anyone know how this can be fixed? Thanks.

Tags (2)
1 Solution

svasan_splunk
Splunk Employee
Splunk Employee

jackiewkc,

Did the master start up okay? I suspect there is probably an error in the log saying clustering was not initialized on the master. The master needs a 'site=...' attribute too which is missing in your config. The site attribute should be under [general] stanza as dxu pointed out. Also site_replication_factor and site_search_factor are need on the master not the searchheads.

See: http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Multisiteconffile

The cli commands for setting up indexer clustering will put the entries under the right stanza. See: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/MultisiteCLI

View solution in original post

mgonter_splunk
Splunk Employee
Splunk Employee

You need to have multisite = true on the search head. It's confusing based on the server.conf.spec because it says it used to inilizae the master. However, this needs to be on your search heads and Cluster Master. Not your indexers. The Site= Site1 needs to be on the indexers. But the search head config needs the following:

[general]
site = site1

[clustering]
multisite = true
master_uri = https:/A.IP.Address:8089
mode = searchhead

http://docs.splunk.com/Documentation/Splunk/6.2.3/Indexer/Multisiteconffile

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Pls ensure that mutlisite = true is entered in [general] stanza in the Cluster Master and restart the Cluster Master.

0 Karma

svasan_splunk
Splunk Employee
Splunk Employee

jackiewkc,

Did the master start up okay? I suspect there is probably an error in the log saying clustering was not initialized on the master. The master needs a 'site=...' attribute too which is missing in your config. The site attribute should be under [general] stanza as dxu pointed out. Also site_replication_factor and site_search_factor are need on the master not the searchheads.

See: http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Multisiteconffile

The cli commands for setting up indexer clustering will put the entries under the right stanza. See: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/MultisiteCLI

View solution in original post

jackiewkc
Path Finder

Thanks. Adding site=1 to the master and then restarting it fixed the issue.

0 Karma

jkat54
SplunkTrust
SplunkTrust

you meant site=site1 i assume. site=1 is invalid.

0 Karma

jackiewkc
Path Finder

Thanks a lot for the quick reply. Unfortunately I am unable to figure out why this is happening.

In server.conf on the master, I have this:

[clustering]
mode = master
multisite = true
available_sites = site1, site2

On the two search heads I have got, I have this in server.conf:

[clustering]
master_uri = https://master01:8990/
site_replication_factor = origin:2, total:3
site_search_factor = origin:1, total:2
multisite = true
site = site1

Any idea?

0 Karma

dxu_splunk
Splunk Employee
Splunk Employee

the site= line should go under the [general] stanza, try moving it there

0 Karma

jackiewkc
Path Finder

Hi, seems like the the issue is with missing site= for the master. This is fixed now. Thanks.

0 Karma

kml_uvce
Builder

check multisite and site parameters are properly used in server.conf
http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Serverconf

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!