Getting Data In

Search head cluster & Indexer cluster error :Unknown error for peer.Search Results might be incomplete & Slave is unable to handle request at this time

premforsplunk
Explorer

Hi folks,
I'm trying to troubleshoot couple of production issues, one related to SHC and other related Indexer clustering.
Would be helpful to get any solution to solve them,

Background: A Splunk standalone system has less data but extremely high number of concurrent / real-time searches. The searches themselves are fast-performing.
It was migrated first to (A) 1 Indexer + 3 SH's Cluster setup. It was then attempted to subsequently migrate to (B) 2 Indexers Cluster + 3 SH's Cluster setup.

Issue #1:
- SH dashboards showing error: “Unknown error for peer xx.xx.xx.xxx . Search Results might be incomplete. If this occurs frequently, please check on the peer.”
- This seems to correspond to Indexer errors: “WARN HttpListener - Socket error from xx.xx.xx.xxx.”

Issue #2: Unable to migrate to Indexer cluster setup (B), since error is shown: “ Slave is unable to handle request at this time. This means either slave unable to communicate w/ master OR master does not have peers added to the cluster. Check master dashboard and/or master_uri/secret settings.”

Could anyone help to resolve ? Thanks much in advance.

0 Karma

francisco_mota
Loves-to-Learn Lots

Is there any network latency?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...