Getting Data In

How do I debug 400 error between Search Head and Peer?

AnotherRandomGu
New Member

Hello,
currently I have 3 vms on the same data center same RHEL version and same splunk*.rpm installed on them, one is supposed to act as Master, a SH and an Indexer.

On the SH I get this on the Search Peer list: alt text

The log in question has these interesting lines:
10.74.55.14 - - [08/Sep/2017:11:03:33.150 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms
10.74.55.14 - - [08/Sep/2017:11:03:33.151 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms
10.74.55.14 - - [08/Sep/2017:11:04:33.159 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms
10.74.55.14 - - [08/Sep/2017:11:04:33.160 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms

Here's My SH server.conf:

[general]
serverName = isearchhead
pass4SymmKey = REDACTED


[sslConfig]
sslPassword = REDACTED
enableSplunkdSSL = false
supportSSLV3Only = false
sslVerifyServerCert = false

[lmpool:auto_generated_pool_download-trial]
description = auto_generated_pool_download-trial
quota = MAX
slaves = *
stack_id = download-trial

[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
quota = MAX
slaves = *
stack_id = forwarder

[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
quota = MAX
slaves = *
stack_id = free

[lmpool:auto_generated_pool_enterprise]
description = auto_generated_pool_enterprise
quota = MAX
slaves = *
stack_id = enterprise

[license]
active_group = Enterprise

[clustering]
master_uri = clustermaster:REDACTED:8089
mode = searchhead

[clustermaster:REDACTED:8089]
master_uri = http://REDACTED:8089
multisite = false
pass4SymmKey = REDACTED
site = default
~                                                                                                                                                                                            

And the distsearch.conf:

[distributedSearch]
servers =  https://[Search Peer]:8089/
trySSLFirst = false #this was a shot in the dark for the 5 second thing

[general]
serverName = iindexer1
pass4SymmKey = REDACTED

[sslConfig]
sslPassword = REDACTED
enableSplunkdSSL = false
supportSSLV3Only = false
sslVerifyServerCert = false

[lmpool:auto_generated_pool_download-trial]
description = auto_generated_pool_download-trial
quota = MAX
slaves = *
stack_id = download-trial

[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
quota = MAX
slaves = *
stack_id = forwarder

[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
quota = MAX
slaves = *
stack_id = free

[license]
master_uri = https://[SEARCH HEAD]:8089

[replication_port://9887]

on etc/auth/distServerKeys/isearchhead/trusted.pem of the Search Peer there's the file I pulled from SH according to instructions.

What am I missing here?
Thank you very much.

0 Karma

AnotherRandomGu
New Member

Changed https to http on distsearch.conf and it worked.
I could swear this hadn't worked earlier.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...