Getting Data In

How come replication isn't working on the Index cluster after a reboot?

christopherr_sp
Splunk Employee
Splunk Employee

We had to shut down one of the machines and create a new one. The cluster replication between the new and old ones does not work after a reboot.

The error message that was found in the splunkd.log files was:

ERROR RetryableClientTransaction - transactionDone(): transactionId=0x7fda3f101000
rTxnId=0x7fda3c5fe4d0 success=N HTTP-statusCode=404 HTTP-statusDescription=Not Found retry=N
no_retry_reason="transaction had fatal error" 
1 Solution

christopherr_sp
Splunk Employee
Splunk Employee

It was found that Splunk OnPremise was installed on AWS and all of the ports were closed.

Once port 8089 was opened replication resumed.

The following Documentation Enhancement Request has been raised to be considered in a future release of Splunk.

SPL-163427 Enhancement Request to check all ports are open in an Indexer Cluster/Search Head Cluster environment

The default ports that Splunk uses are below.

What are the ports that I need to open?

https://answers.splunk.com/answers/58888/what-are-the-ports-that-i-need-to-open.html

View solution in original post

0 Karma

christopherr_sp
Splunk Employee
Splunk Employee

It was found that Splunk OnPremise was installed on AWS and all of the ports were closed.

Once port 8089 was opened replication resumed.

The following Documentation Enhancement Request has been raised to be considered in a future release of Splunk.

SPL-163427 Enhancement Request to check all ports are open in an Indexer Cluster/Search Head Cluster environment

The default ports that Splunk uses are below.

What are the ports that I need to open?

https://answers.splunk.com/answers/58888/what-are-the-ports-that-i-need-to-open.html

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...