After deploying a search head clustering, why is authentication to my two indexers failing and am unable to search?

[slawny86]

After deploying a search head cluster, I have a problem with searching anything. SHcluster status is up, but when I logged on each shcluster members, I've noticed in "Distributed environment" -> "Distributed search" -> "Search peers" that authentication to my two indexers failed. In server.conf on each member, pass4SymmKey in [general] stanza and [shclustering] stanza is the same. Has anyone had a similar problem?

[slawny86]

Hello,

I had found solution these problem, pass4SymmKey should be the same for shcluter and indexer cluster

[slawny86]

and I had to change shcluster's member server name in inputs.conf and server.conf, because were duplicated for some hosts in the cluster. After that the problem disaperaed

[jplumsdaine22]

What error did you get after running the splunk edit cluster-config command on the search heads as descibed here: http://docs.splunk.com/Documentation/Splunk/6.3.3/DistSearch/SHCandindexercluster

[slawny86]

Yes, indexers are also in a cluster

[sk314]

Are your indexers also in a cluster?

[sk314]

Have you followed the procedure listed here?
http://docs.splunk.com/Documentation/Splunk/6.2.7/DistSearch/Connectclustersearchheadstosearchpeers