Where and how do I add the multisite attribute for a search head?

[a212830]

Hi,

I am receiving an error on my dev Distributed Management Console, stating that:

Error = 'Master has multisite enabled but the search head is missing the 'multisite' attribute' 

Is there a command to edit this, or should I just edit the server.conf file?

[woodcock]

I finally figured this out. The problem is that there is a bug in the error logic and the text is completely wrong! What it should say is something like

Error = Master has multisite enabled but the search head is missing the 'multisite' or any 'site=' attribute

In my case, it was the site=site1 that was missing. When I added this, it fixed the problem. Running this command will fix this because it will add site=site to server.conf, not because it changes anything with multisite:

splunk edit cluster-config -mode searchhead -site site1 -master_uri https://xx.xxx.xx.xxx:808

However you should not be configuring clusters through the CLI or GUI into /opt/splunk/etc/system, you should be configuring them through the configuration files, which is why I am pointing out the true nature of the problem and the right way to fix it.

[jbradshaw]

This worked for me I had to add the following to the "/opt/splunk/etc/system/local/server.conf"

[general]
site = site2

[clustering]
master_uri = https://s2-cm:8089
mode = searchhead
multisite = true

[aholzer]

splunk edit cluster-config -mode searchhead -site site1 -master_uri https://xx.xxx.xx.xxx:8089  
splunk restart

Change
- "site1" to whatever site the SH is located in
- "xx.xxx.xx.xxx" to whatever the ip or hostname of your Cluster Master is
- "8089" to the management port you are using on your Cluster Master

All this was gotten from the Splunk docs:
http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/MultisiteCLI

Hope this helps