how to find out if all our search heads in search head cluster environment is in sync?

[sim_tcr]

Hello,

We are running 6.3.3 with search head clustering and 4 search heads in the cluster.
Some times users complain that, few of the saved items are not visible when they come back. We believe its due to the item saved earlier did not get synced with other search heads.
Is there way/command we can easily find out if all the search heads are in sync?

Thanks,
Simon Mandy

[somesoni2 · Accepted solution]

If you've setup DMC, you should be able to see replication status in Search Head clustering related dashboards.

https://docs.splunk.com/Documentation/Splunk/6.3.10/DistSearch/ViewSHCstatusinDMC

[skoelpin]

You should first identify which members are out of sync.. You can do this by looking at the internal logs

Once identified, run this command on the SH member that is out of sync

$SPLUNK_HOME/bin/splunk resync shcluster-replicated-config

[sbbadri]

splunk resync shcluster-replicated-config - is one option

Caution: This command causes an overwrite of the member's entire set of search-related configurations, resulting in the loss of any local changes.