Deployment Architecture

how to enable initialized flag in search head cluster

maede_yavari
Explorer

Hi,

we have deployed a search head cluster with two search head and one deployer.

when we run : /opt/splunk/bin/splunk apply shcluster-bundle -target  https://sh1.example.com:8089

we get the following message:

Error when issuing rolling restart on the master: Internal Server Error{"messages":[{"type":"ERROR","text":"Rolling restart cannot be initiated without service_ready_flag = 1, check status through \"splunk show shcluster-status\". Reason :Waiting for 3 peers to register. (Number registered so far: 2)"}]}

and when we run the following command:

splunk show shcluster-status

the initialized_flag equal 0.

 

Captain:
dynamic_captain : 1
elected_captain : Wed Nov 8 13:05:58 2023
id : 84F622C1-C493-4A7C-B12B-D7EDBBCCD3A8
initialized_flag : 0
kvstore_maintenance_status : disabled
label : sh2
mgmt_uri : https://sh2.example.com:8089
min_peers_joined_flag : 0
rolling_restart_flag : 0
service_ready_flag : 0

Members:
sh2
label : sh2
mgmt_uri : https://sh2.example.com:8089
mgmt_uri_alias : https://sh2.example.com:8089
status : Up


sh1-server
label : sh1-server
last_conf_replication : Pending
mgmt_uri : https://sh1.example.com:8089
mgmt_uri_alias : https://sh1.example.com:8089
status : Up

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @maede_yavari,

each Search Head Cluster requires at least three nodes not two and a Deployer as you can read at https://docs.splunk.com/Documentation/Splunk/9.1.1/DistSearch/SHCarchitecture

Ciao.

Giuseppe

FelixLeh
Contributor

 Check in the Monitoring Console -> Settings -> General Setup
If all Roles are assigned correctly.  Is distributed mode turned on?

0 Karma
Get Updates on the Splunk Community!

3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...

What's New in Splunk Cloud Platform 9.2.2406?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2406 with many ...

Enterprise Security Content Update (ESCU) | New Releases

In August, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...