Deployment Architecture

Why are new indexers not updated even though indexer discovery is enabled in both master node and deployment server?


I just enabled my indexer discovery on my master node and on my deployment server.  I then added three (3) new indexers. I have added the new indexers to the license master and also did indexer clustering on the three new indexers. Then I discover the following

1. My pass4SmmyKey is still showing (ie it did not ash)

2. The Ip addresses of the new indexers added were not updated in the deployment server so not also updated in deployment clients

Labels (2)
Tags (1)
0 Karma


1. If the pass4SymmKey value is not hashed then the instance has not restarted since it was set.  Restart the Splunk instance.

2.  The Deployment Server is not responsible for passing indexer IP addresses to clients.  Once the clients know Indexer Discovery is available (usually via a deployed app), they will contact the Cluster Manager (f.k.a. Cluster Master/Master Node) for available indexers.

Since the DS is also sending its logs to the indexers, it also needs to use Indexer Discovery to learn where the indexers are, but it does not pass the information on to DS clients.

Since the pass4SymmKey is not hashed, I suspect the new indexers did not restart and join the cluster properly.  Once they're restarted they should join the cluster and be known to clients.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...