Deployment Architecture

Why does our distributed management console see one search head cluster member with a GUID label instead of the shcluster_label?

deejay1
Explorer

I have set the shcluster_label on the search head cluster members after deployment. The label is also set on the deployer. Unfortunately, the distributed management console sees two cluster members with the proper label and one member with a GUID label.

I tried to reinstall the member (after removing it according to http://docs.splunk.com/Documentation/Splunk/6.2.0/DistSearch/Removeaclustermember) but to no avail 😞

This seems to mess with the "Search Head Clustering: Status and Configuration" page, even though all 3 hosts are listed under "Snapshots" only two of them are visible on "Historical Charts" and when I switch to the GUID named cluster only the missing one is visible...

Any hints on how to fix this?

0 Karma
1 Solution

deejay1
Explorer

OK, I edited $SPLUNK_HOME/etc/system/local/distsearch.conf, moving the problematic search head from the GUID group to the labelled group and also removed it's mention from $SPLUNK_HOME/etc/apps/splunk_management_console/local/splunk_management_console_assets.conf
This seems to have fixed the problem

View solution in original post

0 Karma

deejay1
Explorer

OK, I edited $SPLUNK_HOME/etc/system/local/distsearch.conf, moving the problematic search head from the GUID group to the labelled group and also removed it's mention from $SPLUNK_HOME/etc/apps/splunk_management_console/local/splunk_management_console_assets.conf
This seems to have fixed the problem

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...