Deployment Architecture

Why are new indexers not updated even though indexer discovery is enabled in both master node and deployment server?

Ronkeadebayo
Observer

I just enabled my indexer discovery on my master node and on my deployment server.  I then added three (3) new indexers. I have added the new indexers to the license master and also did indexer clustering on the three new indexers. Then I discover the following

1. My pass4SmmyKey is still showing (ie it did not ash)

2. The Ip addresses of the new indexers added were not updated in the deployment server so not also updated in deployment clients

Labels (2)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

1. If the pass4SymmKey value is not hashed then the instance has not restarted since it was set.  Restart the Splunk instance.

2.  The Deployment Server is not responsible for passing indexer IP addresses to clients.  Once the clients know Indexer Discovery is available (usually via a deployed app), they will contact the Cluster Manager (f.k.a. Cluster Master/Master Node) for available indexers.

Since the DS is also sending its logs to the indexers, it also needs to use Indexer Discovery to learn where the indexers are, but it does not pass the information on to DS clients.

Since the pass4SymmKey is not hashed, I suspect the new indexers did not restart and join the cluster properly.  Once they're restarted they should join the cluster and be known to clients.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...