Deployment Architecture

Why does our distributed management console see one search head cluster member with a GUID label instead of the shcluster_label?

deejay1
Explorer

I have set the shcluster_label on the search head cluster members after deployment. The label is also set on the deployer. Unfortunately, the distributed management console sees two cluster members with the proper label and one member with a GUID label.

I tried to reinstall the member (after removing it according to http://docs.splunk.com/Documentation/Splunk/6.2.0/DistSearch/Removeaclustermember) but to no avail 😞

This seems to mess with the "Search Head Clustering: Status and Configuration" page, even though all 3 hosts are listed under "Snapshots" only two of them are visible on "Historical Charts" and when I switch to the GUID named cluster only the missing one is visible...

Any hints on how to fix this?

0 Karma
1 Solution

deejay1
Explorer

OK, I edited $SPLUNK_HOME/etc/system/local/distsearch.conf, moving the problematic search head from the GUID group to the labelled group and also removed it's mention from $SPLUNK_HOME/etc/apps/splunk_management_console/local/splunk_management_console_assets.conf
This seems to have fixed the problem

View solution in original post

0 Karma

deejay1
Explorer

OK, I edited $SPLUNK_HOME/etc/system/local/distsearch.conf, moving the problematic search head from the GUID group to the labelled group and also removed it's mention from $SPLUNK_HOME/etc/apps/splunk_management_console/local/splunk_management_console_assets.conf
This seems to have fixed the problem

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...