Hello,
We are running 6.3.3 with search head clustering and 4 search heads in the cluster.
Some times users complain that, few of the saved items are not visible when they come back. We believe its due to the item saved earlier did not get synced with other search heads.
Is there way/command we can easily find out if all the search heads are in sync?
Thanks,
Simon Mandy
If you've setup DMC, you should be able to see replication status in Search Head clustering related dashboards.
https://docs.splunk.com/Documentation/Splunk/6.3.10/DistSearch/ViewSHCstatusinDMC
If you've setup DMC, you should be able to see replication status in Search Head clustering related dashboards.
https://docs.splunk.com/Documentation/Splunk/6.3.10/DistSearch/ViewSHCstatusinDMC
You should first identify which members are out of sync.. You can do this by looking at the internal logs
Once identified, run this command on the SH member that is out of sync
$SPLUNK_HOME/bin/splunk resync shcluster-replicated-config
splunk resync shcluster-replicated-config - is one option
Caution: This command causes an overwrite of the member's entire set of search-related configurations, resulting in the loss of any local changes.