Deployment Architecture
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

Why does our distributed management console see one search head cluster member with a GUID label instead of the shcluster_label?

deejay1
Explorer

I have set the shcluster_label on the search head cluster members after deployment. The label is also set on the deployer. Unfortunately, the distributed management console sees two cluster members with the proper label and one member with a GUID label.

I tried to reinstall the member (after removing it according to http://docs.splunk.com/Documentation/Splunk/6.2.0/DistSearch/Removeaclustermember) but to no avail 😞

This seems to mess with the "Search Head Clustering: Status and Configuration" page, even though all 3 hosts are listed under "Snapshots" only two of them are visible on "Historical Charts" and when I switch to the GUID named cluster only the missing one is visible...

Any hints on how to fix this?

0 Karma
1 Solution

deejay1
Explorer

OK, I edited $SPLUNK_HOME/etc/system/local/distsearch.conf, moving the problematic search head from the GUID group to the labelled group and also removed it's mention from $SPLUNK_HOME/etc/apps/splunk_management_console/local/splunk_management_console_assets.conf
This seems to have fixed the problem

View solution in original post

0 Karma

deejay1
Explorer

OK, I edited $SPLUNK_HOME/etc/system/local/distsearch.conf, moving the problematic search head from the GUID group to the labelled group and also removed it's mention from $SPLUNK_HOME/etc/apps/splunk_management_console/local/splunk_management_console_assets.conf
This seems to have fixed the problem

View solution in original post

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!