Deployment Architecture
Highlighted

Why does my search peer come up as an error on my search head?

Communicator

I've added a search head as a search peer and it's come up as "sick" with the following error. Can't seem to find any reference to it here.

Error [00800000] Failed 11 out of 11 times. Servername used by peer is already in use by the search head.

It suggests a dns issue, but none exists that I can see.

Highlighted

Re: Why does my search peer come up as an error on my search head?

Splunk Employee
Splunk Employee

From your search head, when you do a host or dig against the peer hostname, what does it return?

Check your server.conf file on the search head and make sure all the host names are correct.

If youre on linux, you could consider using the local /etc/hosts file as a work around.. This wouldnt be recommended for a sustained production environment..

View solution in original post

Highlighted

Re: Why does my search peer come up as an error on my search head?

Communicator

That was it. Had duplicate IP's in the server.conf file. Not sure how that happened but good call.

Interestingly the same search head is not being seen by the Distributed Management console and this didn't resolve that problem.

0 Karma
Highlighted

Re: Why does my search peer come up as an error on my search head?

Splunk Employee
Splunk Employee

Glad that fixed it.

For your DMC host, you'll need to add the other Splunk nodes as search peers in order for the DMC to work properly. If you have previously added them, I would check the server.conf on the DMC host and make sure the resolution is correct there also.

0 Karma
Highlighted

Re: Why does my search peer come up as an error on my search head?

Explorer

resolved: I checked the server.conf , server name was wrong, after editing the name and restarting all are good

0 Karma