Getting Data In
Highlighted

Search head is not communicating with its peer(Indexer)

Explorer

Error [00000080] Instance name "XXX.XXX.XXX.XXX:8089" REST interface to peer is taking longer than 5 seconds to respond on https. Peer may be over subscribed or misconfigured. Check var/log/splunk/splunkd_access.log on the peer Last Connect Time:2018-01-12T09:46:13.000-05:00; Failed 10 out of 10 times.

0 Karma
Highlighted

Re: Search head is not communicating with its peer(Indexer)

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: Search head is not communicating with its peer(Indexer)

Explorer

I don't think that is the issue. I have 2 indexers. One of the indexer is working fine and is connected to search head but the other is not.

0 Karma
Highlighted

Re: Search head is not communicating with its peer(Indexer)

Explorer

I have the similar issue.
Please give us the solution for this.

0 Karma
Highlighted

Re: Search head is not communicating with its peer(Indexer)

New Member

I had this issue and I had to distribute the public SSL key from the search head to the peer (indexer).

Settings > Distributed Search > Search Peers >

click on the peer in question and enter the admin/password

0 Karma
Highlighted

Re: Search head is not communicating with its peer(Indexer)

Ultra Champion

Assuming no Splunk config changes, could your indexer be bogged down with something else?
From the searchhead try:
curl -k -u admin:changeme https://your_missing_indexer:8089/services/server/info

If you get no response, check the normal things, such as "is splunk actually running", server load, network etc etc

Aldo take a look for errors in /opt/splunk/var/log/splunk/splunkd.log?