Deployment Architecture

Various problems with bundle replication; unauthorized and generic error

manderson7
Contributor

Running a 2 site indexer cluster configuration, with 2 search head clusters.
Site 1 shows a search head with the following error:

Search peer site1sh08u has the following message: Bundle Replication: Problem replicating config (bundle) to search peer ' 172.30.63.42:8089 ', error while transmitting bundle data.

Site 2 is showing the following error:

Search peer site2sh01u has the following message: Bundle Replication: Problem replicating config (bundle) to search peer ' 172.31.133.16:8089 ', got http response code 401 HTTP/1.1 401 Unauthorized.
Search peer site2sh01u has the following message: Bundle Replication: Problem replicating config (bundle) to search peer ' 172.31.133.17:8089 ', got http response code 401 HTTP/1.1 401 Unauthorized.
Search peer site2sh01u has the following message: Bundle Replication: Problem replicating config (bundle) to search peer ' 172.31.133.18:8089 ', got http response code 401 HTTP/1.1 401 Unauthorized.

What authentication is the message from site 2 referring to? Where can I find more information about these messages?

0 Karma

manderson7
Contributor

Never mind, looks like a restart of all the search heads did the trick.

0 Karma

woodcock
Esteemed Legend

Be sure to click 'Accept` to close out the question.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...