Deployment Architecture

Why does our distributed management console see one search head cluster member with a GUID label instead of the shcluster_label?

deejay1
Explorer

I have set the shcluster_label on the search head cluster members after deployment. The label is also set on the deployer. Unfortunately, the distributed management console sees two cluster members with the proper label and one member with a GUID label.

I tried to reinstall the member (after removing it according to http://docs.splunk.com/Documentation/Splunk/6.2.0/DistSearch/Removeaclustermember) but to no avail 😞

This seems to mess with the "Search Head Clustering: Status and Configuration" page, even though all 3 hosts are listed under "Snapshots" only two of them are visible on "Historical Charts" and when I switch to the GUID named cluster only the missing one is visible...

Any hints on how to fix this?

0 Karma
1 Solution

deejay1
Explorer

OK, I edited $SPLUNK_HOME/etc/system/local/distsearch.conf, moving the problematic search head from the GUID group to the labelled group and also removed it's mention from $SPLUNK_HOME/etc/apps/splunk_management_console/local/splunk_management_console_assets.conf
This seems to have fixed the problem

View solution in original post

0 Karma

deejay1
Explorer

OK, I edited $SPLUNK_HOME/etc/system/local/distsearch.conf, moving the problematic search head from the GUID group to the labelled group and also removed it's mention from $SPLUNK_HOME/etc/apps/splunk_management_console/local/splunk_management_console_assets.conf
This seems to have fixed the problem

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...