The searchhead is unable to update the peer information. Error = 'Master has multisite enabled but it is missing the 'multisite' attribute' for master=https://127.0.0.1:8990

[jackiewkc]

Does anyone know how this can be fixed? Thanks.

[mgonter_splunk]

You need to have multisite = true on the search head. It's confusing based on the server.conf.spec because it says it used to inilizae the master. However, this needs to be on your search heads and Cluster Master. Not your indexers. The Site= Site1 needs to be on the indexers. But the search head config needs the following:

[general]
site = site1

[clustering]
multisite = true
master_uri = https:/A.IP.Address:8089
mode = searchhead

http://docs.splunk.com/Documentation/Splunk/6.2.3/Indexer/Multisiteconffile

[lakshman239]

Pls ensure that mutlisite = true is entered in [general] stanza in the Cluster Master and restart the Cluster Master.

[svasan_splunk · Accepted solution]

jackiewkc,

Did the master start up okay? I suspect there is probably an error in the log saying clustering was not initialized on the master. The master needs a 'site=...' attribute too which is missing in your config. The site attribute should be under [general] stanza as dxu pointed out. Also site_replication_factor and site_search_factor are need on the master not the searchheads.

See: http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Multisiteconffile

The cli commands for setting up indexer clustering will put the entries under the right stanza. See: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/MultisiteCLI

[jackiewkc]

Thanks. Adding site=1 to the master and then restarting it fixed the issue.

[jkat54]

you meant site=site1 i assume. site=1 is invalid.

[jackiewkc]

Thanks a lot for the quick reply. Unfortunately I am unable to figure out why this is happening.

In server.conf on the master, I have this:

[clustering]
mode = master
multisite = true
available_sites = site1, site2

On the two search heads I have got, I have this in server.conf:

[clustering]
master_uri = https://master01:8990/
site_replication_factor = origin:2, total:3
site_search_factor = origin:1, total:2
multisite = true
site = site1

Any idea?

[dxu_splunk]

the site= line should go under the [general] stanza, try moving it there

[jackiewkc]

Hi, seems like the the issue is with missing site= for the master. This is fixed now. Thanks.

[kml_uvce]

check multisite and site parameters are properly used in server.conf
http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Serverconf