Deployment Architecture

how to enable initialized flag in search head cluster

maede_yavari
Explorer

Hi,

we have deployed a search head cluster with two search head and one deployer.

when we run : /opt/splunk/bin/splunk apply shcluster-bundle -target  https://sh1.example.com:8089

we get the following message:

Error when issuing rolling restart on the master: Internal Server Error{"messages":[{"type":"ERROR","text":"Rolling restart cannot be initiated without service_ready_flag = 1, check status through \"splunk show shcluster-status\". Reason :Waiting for 3 peers to register. (Number registered so far: 2)"}]}

and when we run the following command:

splunk show shcluster-status

the initialized_flag equal 0.

 

Captain:
dynamic_captain : 1
elected_captain : Wed Nov 8 13:05:58 2023
id : 84F622C1-C493-4A7C-B12B-D7EDBBCCD3A8
initialized_flag : 0
kvstore_maintenance_status : disabled
label : sh2
mgmt_uri : https://sh2.example.com:8089
min_peers_joined_flag : 0
rolling_restart_flag : 0
service_ready_flag : 0

Members:
sh2
label : sh2
mgmt_uri : https://sh2.example.com:8089
mgmt_uri_alias : https://sh2.example.com:8089
status : Up


sh1-server
label : sh1-server
last_conf_replication : Pending
mgmt_uri : https://sh1.example.com:8089
mgmt_uri_alias : https://sh1.example.com:8089
status : Up

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @maede_yavari,

each Search Head Cluster requires at least three nodes not two and a Deployer as you can read at https://docs.splunk.com/Documentation/Splunk/9.1.1/DistSearch/SHCarchitecture

Ciao.

Giuseppe

FelixLeh
Contributor

 Check in the Monitoring Console -> Settings -> General Setup
If all Roles are assigned correctly.  Is distributed mode turned on?

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...