Deployment Architecture

how to enable initialized flag in search head cluster

maede_yavari
Explorer

Hi,

we have deployed a search head cluster with two search head and one deployer.

when we run : /opt/splunk/bin/splunk apply shcluster-bundle -target  https://sh1.example.com:8089

we get the following message:

Error when issuing rolling restart on the master: Internal Server Error{"messages":[{"type":"ERROR","text":"Rolling restart cannot be initiated without service_ready_flag = 1, check status through \"splunk show shcluster-status\". Reason :Waiting for 3 peers to register. (Number registered so far: 2)"}]}

and when we run the following command:

splunk show shcluster-status

the initialized_flag equal 0.

 

Captain:
dynamic_captain : 1
elected_captain : Wed Nov 8 13:05:58 2023
id : 84F622C1-C493-4A7C-B12B-D7EDBBCCD3A8
initialized_flag : 0
kvstore_maintenance_status : disabled
label : sh2
mgmt_uri : https://sh2.example.com:8089
min_peers_joined_flag : 0
rolling_restart_flag : 0
service_ready_flag : 0

Members:
sh2
label : sh2
mgmt_uri : https://sh2.example.com:8089
mgmt_uri_alias : https://sh2.example.com:8089
status : Up


sh1-server
label : sh1-server
last_conf_replication : Pending
mgmt_uri : https://sh1.example.com:8089
mgmt_uri_alias : https://sh1.example.com:8089
status : Up

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @maede_yavari,

each Search Head Cluster requires at least three nodes not two and a Deployer as you can read at https://docs.splunk.com/Documentation/Splunk/9.1.1/DistSearch/SHCarchitecture

Ciao.

Giuseppe

FelixLeh
Contributor

 Check in the Monitoring Console -> Settings -> General Setup
If all Roles are assigned correctly.  Is distributed mode turned on?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...