Getting Data In

How to troubleshoot why a Splunk peer node is failing to connect to the master node in an indexer clustering environment?

amoldesai
Explorer

I am using Splunk 6.3.3. My Splunk indexer clustering environment was working fine earlier. Now one of the peer nodes is unable to connect to the master node.

I don't see the peer node in the indexer view of the master dashboard. When I try to view the Setting-->Distributed Environment-->Index Clustering view on the peer node, I get the following error message:

In handler 'clusterslavecontrol': Slave is unable to handle request at this time.  This means either slave unable to communicate w/ master OR master does not have  peers added to the cluster.  Check master dashboard and/or master_uri/secret settings.

Request your help in troubleshooting this problem.

Thanks

0 Karma

ddrillic
Ultra Champion

http://docs.splunk.com/Documentation/Splunk/6.3.0/RESTREF/RESTcluster speaks about it -

It says about secret -
Secret shared among the nodes in the cluster to prevent any arbitrary node from connecting to the cluster. If a peer or searchhead is not configured with the same secret as the master, it is not able to communicate with the master.

0 Karma

amoldesai
Explorer

Thanks for your reply.

I now have the same secret key as that in the master node(pass4SymmKey value in the server.conf file under local directory).
But I continue to get the same error.
Any ideas ?

As this is my dev environment, I am also ok to clean the data/configuration on this peer node and reconfigure it. What steps need to followed to reconfigure the peer node.

Thanks

0 Karma

amoldesai
Explorer

More information regarding the above issue. In the UI of master mode, I see a message as :

Failed to add peer 'guid=E975B264-926A-4E16-9FC9-4AE355086032 server name= ip=:8089 timed out; exceeded 30sec.

Thanks

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...