Deployment Architecture

captain fails to bootstrap in new search head cluster

jamesmatthews
New Member

I have 3 new splunk servers which have been Initialized to be used in a cluster and a deployer.

when trying to bootstrap the captain i get the following error:
Failed to Set Configuration. One potential reason is captain could not hear back from all the nodes in a timeout period. Ensure all to be added nodes are up, and increase the raft timeout. If all nodes are up and running, look at splunkd.log for appendEntries errors due to mgmt_uri mismatch .

upon looking at the splunkd.log file i see a whole raft of these errors:

04-25-2018 15:09:55.676 +0100 ERROR HttpClientRequest - HTTP client error: Connection reset by peer (while accessing http:
//eusplunks06:8089/services/shcluster/captain/members/1AEB90B8-99D0-404A-8B54-FA5FA676E8DB)
04-25-2018 15:09:55.676 +0100 WARN SHCMasterHTTPProxy - Low Level http request failure err=failed method=POST path=/servi
ces/shcluster/captain/members/1AEB90B8-99D0-404A-8B54-FA5FA676E8DB captain=eusplunks06:8089 rc=0 actual_response_code=502
expected_response_code=200 status_line="Connection reset by peer" socket_error="Connection reset by peer"
04-25-2018 15:09:56.652 +0100 WARN ConfReplicationBookmark - serializeToJson: tried to serialize an empty bookmark
04-25-2018 15:09:56.652 +0100 WARN SHCHouseKeepingThread - writeSHCStateToStateStore: failed to serialize the bookmark
04-25-2018 15:10:00.682 +0100 WARN HttpListener - Socket error from 10.172.173.47 while idling: error:1407609C:SSL routin
es:SSL23_GET_CLIENT_HELLO:http request

has anyone had this issue before?

many thanks in advance.
James m

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...