Deployment Architecture

Why is my search head cluster captain logging KV Store replication errors?

twinspop
Influencer

The log is repeating at sub-second intervals:

2017-10-27T20:44:53.389Z I REPL [ReplicationExecutor] Error in heartbeat request to shccaptain:8191; InvalidReplicaSetConfig Our replica set configuration is invalid or does not include us

The kvstore appears to be healthy otherwise.

> curl -sku admin:password https://shcmember:8089/services/server/info | grep -i kv
<s:key name="kvStoreStatus">ready</s:key>

> curl -sku admin:password https://shccaptain:8089/services/server/info | grep -i kv
<s:key name="kvStoreStatus">ready</s:key>

What's the problem? What's the fix?

EDIT: The error started after creating a collection by running this curl command:

curl -ku admin -d name=userid https://shcmember:8089/servicesNS/nobody/alpha_search/storage/collections/config

1 Solution

twinspop
Influencer

Splunk Support provided this solution:

on the SHC captain, splunk stop, then splunk clean kvstore --local, accept the scary warning message, and finally restart splunk. The errors have subsided and as far as I can tell, no damage was done.

Hope this helps a future admin.

View solution in original post

twinspop
Influencer

Splunk Support provided this solution:

on the SHC captain, splunk stop, then splunk clean kvstore --local, accept the scary warning message, and finally restart splunk. The errors have subsided and as far as I can tell, no damage was done.

Hope this helps a future admin.

peter_krammer
Communicator

Thanks!
Has the same problem today and changing the captain did not help.
But running this on the problematic host, solved it.

0 Karma

delink
Communicator

A slightly safer way to do this is just transfer the captaincy to another member of the cluster so that it rebuilds the replicaSet configuration for mongod. No stops or cleans required.

https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Transfercaptain#Change_the_captain

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI
can you share collection configuration?

0 Karma

twinspop
Influencer

The collection was configured as above. No other settings applied. These are the defaults as far as I can tell:


[userid]
profilingEnabled = false
profilingThresholdMs = 1000
replicate = false
replication_dump_maximum_file_size = 10240
replication_dump_strategy = auto
type = undefined

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi

Can you please try below stanza?

[userid] 
replicate = true
enforceTypes = false

I have removed other configuration bcoz those have assigned to default values. Make sure about configuration would same in entire cluster.

Thanks

0 Karma

twinspop
Influencer

I should say that i have many other collections running, with exactly the same creation procedure. None triggered this error repeating. That said, I added the configs you suggested above to this single collection via the REST API. Confirmed via btool. The errors continue.

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...