Getting Data In

Search head cluster & Indexer cluster error :Unknown error for peer.Search Results might be incomplete & Slave is unable to handle request at this time

premforsplunk
Explorer

Hi folks,
I'm trying to troubleshoot couple of production issues, one related to SHC and other related Indexer clustering.
Would be helpful to get any solution to solve them,

Background: A Splunk standalone system has less data but extremely high number of concurrent / real-time searches. The searches themselves are fast-performing.
It was migrated first to (A) 1 Indexer + 3 SH's Cluster setup. It was then attempted to subsequently migrate to (B) 2 Indexers Cluster + 3 SH's Cluster setup.

Issue #1:
- SH dashboards showing error: “Unknown error for peer xx.xx.xx.xxx . Search Results might be incomplete. If this occurs frequently, please check on the peer.”
- This seems to correspond to Indexer errors: “WARN HttpListener - Socket error from xx.xx.xx.xxx.”

Issue #2: Unable to migrate to Indexer cluster setup (B), since error is shown: “ Slave is unable to handle request at this time. This means either slave unable to communicate w/ master OR master does not have peers added to the cluster. Check master dashboard and/or master_uri/secret settings.”

Could anyone help to resolve ? Thanks much in advance.

0 Karma

francisco_mota
Loves-to-Learn Lots

Is there any network latency?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...