Deployment Architecture

Why are new indexers not updated even though indexer discovery is enabled in both master node and deployment server?

Ronkeadebayo
Observer

I just enabled my indexer discovery on my master node and on my deployment server.  I then added three (3) new indexers. I have added the new indexers to the license master and also did indexer clustering on the three new indexers. Then I discover the following

1. My pass4SmmyKey is still showing (ie it did not ash)

2. The Ip addresses of the new indexers added were not updated in the deployment server so not also updated in deployment clients

Labels (2)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

1. If the pass4SymmKey value is not hashed then the instance has not restarted since it was set.  Restart the Splunk instance.

2.  The Deployment Server is not responsible for passing indexer IP addresses to clients.  Once the clients know Indexer Discovery is available (usually via a deployed app), they will contact the Cluster Manager (f.k.a. Cluster Master/Master Node) for available indexers.

Since the DS is also sending its logs to the indexers, it also needs to use Indexer Discovery to learn where the indexers are, but it does not pass the information on to DS clients.

Since the pass4SymmKey is not hashed, I suspect the new indexers did not restart and join the cluster properly.  Once they're restarted they should join the cluster and be known to clients.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...