Getting Data In

Search head cluster & Indexer cluster error :Unknown error for peer.Search Results might be incomplete & Slave is unable to handle request at this time

premforsplunk
Explorer

Hi folks,
I'm trying to troubleshoot couple of production issues, one related to SHC and other related Indexer clustering.
Would be helpful to get any solution to solve them,

Background: A Splunk standalone system has less data but extremely high number of concurrent / real-time searches. The searches themselves are fast-performing.
It was migrated first to (A) 1 Indexer + 3 SH's Cluster setup. It was then attempted to subsequently migrate to (B) 2 Indexers Cluster + 3 SH's Cluster setup.

Issue #1:
- SH dashboards showing error: “Unknown error for peer xx.xx.xx.xxx . Search Results might be incomplete. If this occurs frequently, please check on the peer.”
- This seems to correspond to Indexer errors: “WARN HttpListener - Socket error from xx.xx.xx.xxx.”

Issue #2: Unable to migrate to Indexer cluster setup (B), since error is shown: “ Slave is unable to handle request at this time. This means either slave unable to communicate w/ master OR master does not have peers added to the cluster. Check master dashboard and/or master_uri/secret settings.”

Could anyone help to resolve ? Thanks much in advance.

0 Karma

francisco_mota
Loves-to-Learn Lots

Is there any network latency?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...