Getting Data In

How do I debug 400 error between Search Head and Peer?

AnotherRandomGu
New Member

Hello,
currently I have 3 vms on the same data center same RHEL version and same splunk*.rpm installed on them, one is supposed to act as Master, a SH and an Indexer.

On the SH I get this on the Search Peer list: alt text

The log in question has these interesting lines:
10.74.55.14 - - [08/Sep/2017:11:03:33.150 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms
10.74.55.14 - - [08/Sep/2017:11:03:33.151 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms
10.74.55.14 - - [08/Sep/2017:11:04:33.159 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms
10.74.55.14 - - [08/Sep/2017:11:04:33.160 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms

Here's My SH server.conf:

[general]
serverName = isearchhead
pass4SymmKey = REDACTED


[sslConfig]
sslPassword = REDACTED
enableSplunkdSSL = false
supportSSLV3Only = false
sslVerifyServerCert = false

[lmpool:auto_generated_pool_download-trial]
description = auto_generated_pool_download-trial
quota = MAX
slaves = *
stack_id = download-trial

[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
quota = MAX
slaves = *
stack_id = forwarder

[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
quota = MAX
slaves = *
stack_id = free

[lmpool:auto_generated_pool_enterprise]
description = auto_generated_pool_enterprise
quota = MAX
slaves = *
stack_id = enterprise

[license]
active_group = Enterprise

[clustering]
master_uri = clustermaster:REDACTED:8089
mode = searchhead

[clustermaster:REDACTED:8089]
master_uri = http://REDACTED:8089
multisite = false
pass4SymmKey = REDACTED
site = default
~                                                                                                                                                                                            

And the distsearch.conf:

[distributedSearch]
servers =  https://[Search Peer]:8089/
trySSLFirst = false #this was a shot in the dark for the 5 second thing

[general]
serverName = iindexer1
pass4SymmKey = REDACTED

[sslConfig]
sslPassword = REDACTED
enableSplunkdSSL = false
supportSSLV3Only = false
sslVerifyServerCert = false

[lmpool:auto_generated_pool_download-trial]
description = auto_generated_pool_download-trial
quota = MAX
slaves = *
stack_id = download-trial

[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
quota = MAX
slaves = *
stack_id = forwarder

[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
quota = MAX
slaves = *
stack_id = free

[license]
master_uri = https://[SEARCH HEAD]:8089

[replication_port://9887]

on etc/auth/distServerKeys/isearchhead/trusted.pem of the Search Peer there's the file I pulled from SH according to instructions.

What am I missing here?
Thank you very much.

0 Karma

AnotherRandomGu
New Member

Changed https to http on distsearch.conf and it worked.
I could swear this hadn't worked earlier.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Mile High Learning with Splunk University, Denver, Colorado

If Denver is known for its mile-high elevation, Splunk University is about to raise the bar on technical ...

IT Service Intelligence 5.0 Series: Your Guide to the June Launch

We are excited to announce the June release of Splunk IT Service Intelligence (ITSI) 5.0. This update ...

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...