Getting Data In

Search head is not communicating with its peer(Indexer)

Explorer

Error [00000080] Instance name "XXX.XXX.XXX.XXX:8089" REST interface to peer is taking longer than 5 seconds to respond on https. Peer may be over subscribed or misconfigured. Check var/log/splunk/splunkd_access.log on the peer Last Connect Time:2018-01-12T09:46:13.000-05:00; Failed 10 out of 10 times.

0 Karma

Ultra Champion

Assuming no Splunk config changes, could your indexer be bogged down with something else?
From the searchhead try:
curl -k -u admin:changeme https://your_missing_indexer:8089/services/server/info

If you get no response, check the normal things, such as "is splunk actually running", server load, network etc etc

Aldo take a look for errors in /opt/splunk/var/log/splunk/splunkd.log?

SplunkTrust
SplunkTrust
0 Karma

Explorer

I don't think that is the issue. I have 2 indexers. One of the indexer is working fine and is connected to search head but the other is not.

0 Karma

Explorer

I have the similar issue.
Please give us the solution for this.

0 Karma

Engager

I had this issue and I had to distribute the public SSL key from the search head to the peer (indexer).

Settings > Distributed Search > Search Peers >

click on the peer in question and enter the admin/password

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!