Deployment Architecture

Why can't I re-enable or re-add one member of my search head cluster after upgrading it from 6.4 to 6.5.0?

lycollicott
Motivator

I am following the upgrade instructions at http://docs.splunk.com/Documentation/Splunk/6.5.0/Installation/UpgradeyourdistributedSplunkEnterpris... like so:

Upgrade the search heads
1. Disable one of the search heads.
2. Upgrade the search head. Do not let it restart.
3. After you upgrade the search head, place the confirmed working apps into the $SPLUNK_HOME/etc/apps directory of the search head.
4. Re-enable and restart the search head.
5. Test apps on the search head for operation and functionality.
6. If there are no problems with the search head, then disable and upgrade the remaining search heads, one by one. Repeat this step until you have reached the last search head in your environment.
7. (Optional) Test each search head for operation and functionality after you bring it up.
8. After you upgrade the last search head, test all of the search heads for operation and functionality.

At step 1 I did splunk disable shcluster-config but I have a feeling I screwed that up, because at step 4 I cannot re-enable it with either splunk add shcluster-member -new_member_uri https://blah:8089 or with splunk add shcluster-member -current_member_uri https://blah:8089

What have I messed up on this sunny Friday afternoon?

0 Karma
1 Solution

lycollicott
Motivator

Ok, here is what I did this evening to fix it (I was over complicating it earlier, but it became clearer after I took a break for a few hours.)

splunk init shcluster-config -auth admin:<password> -mgmt_uri https://sh1.domain.com:8089 -replication_port 8999 -replication_factor 3 -conf_deploy_fetch_url https://ds.domain.com:8089 -secret <something>-shcluster_label prodsearch1

splunk restart

splunk add shcluster-member -current_member_uri https://sh2.domain.com:8089

View solution in original post

lycollicott
Motivator

Ok, here is what I did this evening to fix it (I was over complicating it earlier, but it became clearer after I took a break for a few hours.)

splunk init shcluster-config -auth admin:<password> -mgmt_uri https://sh1.domain.com:8089 -replication_port 8999 -replication_factor 3 -conf_deploy_fetch_url https://ds.domain.com:8089 -secret <something>-shcluster_label prodsearch1

splunk restart

splunk add shcluster-member -current_member_uri https://sh2.domain.com:8089

ChrisG
Splunk Employee
Splunk Employee

I'm no expert in this procedure, but I do know that the instructions for upgrading a search head cluster are here:

http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/UpgradeaSHC

lycollicott
Motivator

Oh, if only the other 6.5.0 manual had said that I could have avoided the disable step. Bummer.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

I found it by following a link in the topic you posted....

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...