I am receiving an error on my dev Distributed Management Console, stating that:
Error = 'Master has multisite enabled but the search head is missing the 'multisite' attribute'
Is there a command to edit this, or should I just edit the server.conf file?
I finally figured this out. The problem is that there is a bug in the error logic and the text is completely wrong! What it should say is something like
Error = Master has multisite enabled but the search head is missing the 'multisite' or any 'site=' attribute
In my case, it was the
site=site1 that was missing. When I added this, it fixed the problem. Running this command will fix this because it will add
server.conf, not because it changes anything with
splunk edit cluster-config -mode searchhead -site site1 -master_uri https://xx.xxx.xx.xxx:808
However you should not be configuring clusters through the CLI or GUI into
/opt/splunk/etc/system, you should be configuring them through the configuration files, which is why I am pointing out the true nature of the problem and the right way to fix it.
splunk edit cluster-config -mode searchhead -site site1 -master_uri https://xx.xxx.xx.xxx:8089 splunk restart
- "site1" to whatever site the SH is located in
- "xx.xxx.xx.xxx" to whatever the ip or hostname of your Cluster Master is
- "8089" to the management port you are using on your Cluster Master
All this was gotten from the Splunk docs:
Hope this helps