Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- After deploying a search head clustering, why is a...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After deploying a search head clustering, why is authentication to my two indexers failing and am unable to search?
After deploying a search head cluster, I have a problem with searching anything. SHcluster status is up, but when I logged on each shcluster members, I've noticed in "Distributed environment" -> "Distributed search" -> "Search peers" that authentication to my two indexers failed. In server.conf on each member, pass4SymmKey in [general] stanza and [shclustering] stanza is the same. Has anyone had a similar problem?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I had found solution these problem, pass4SymmKey should be the same for shcluter and indexer cluster
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
and I had to change shcluster's member server name in inputs.conf and server.conf, because were duplicated for some hosts in the cluster. After that the problem disaperaed
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What error did you get after running the splunk edit cluster-config command on the search heads as descibed here: http://docs.splunk.com/Documentation/Splunk/6.3.3/DistSearch/SHCandindexercluster
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, indexers are also in a cluster
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are your indexers also in a cluster?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you followed the procedure listed here?
http://docs.splunk.com/Documentation/Splunk/6.2.7/DistSearch/Connectclustersearchheadstosearchpeers
The OpenTelemetry Certified Associate (OTCA) Exam
From Manual to Agentic: Level Up Your SOC at Cisco Live
Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)
