Getting Data In

Why am I getting the error"Unable to distribute to peer named X.X.X.X:YYYY at uri=X.X.X.X:YYYY using the uri-scheme=https because peer has status="Down" on my search head for all queries?

pavanae
Builder

I am getting the below error on my search head for all the queries.

"Unable to distribute to peer named X.X.X.X:PPPP  at uri=X.X.X.X:PPPP using the uri-scheme=https because peer has status="Down". Please verify uri-scheme, connectivity to the search peer, that the search peer is up, and an adequate level of system resources are available. See the Troubleshooting Manual for more information."

Where X.X.X.X is indexer IP address and PPPP is port.

When I tried to look what's happening in the internal logs I only see the below warning message on all the events

Query used :-index="_internal" source=/cs/splunk/search/var/log/splunk/splunkd.log X.X.X.X

Warning log :- 02-24-2018 16:35:15.331 +0100 WARN  DistributedPeerManager - Unable to distribute to peer named X.X.X.X:PPPP at uri=X.X.X.X:PPPP using the uri-scheme=https because peer has status="Down"

Please verify uri-scheme, connectivity to the search peer, that the search peer is up, and an adequate level of system resources are available. See the Troubleshooting Manual for more information.

I have tried the below to identify the issue

  1. removing the cluster and re-adding it doesn’t resolve this problem
  2. Rebooting the indexer doesn't help
  3. I can see some buckets showing up on indexer when searching it, however, most of them are unavailable.

Could anyone suggest what exactly could be the issue?

Note :- search head version :- 6.5.3 and indexer version for host X.X.X.X is : 6.6.5

I know that upgrading the search head to the version 6.6.5 would resolve this but I'm trying to find the reason why it fails when the search head version is lesser than the indexer version

0 Karma
1 Solution

JDukeSplunk
Builder

My first thought would be SSL negotiation. You might want to check what sslVersions your authentication.conf and server.conf have on the boxes. If the system marking the other "down" only accepts ssl3 and above, but the "down" server is transmitting using ssl2 or ssl1 the receiving server will not be able to negotiate a comm channel with it, and it will fail.

View solution in original post

0 Karma

DBattisto
Communicator

I know this has been marked as solved, but if anyone else finds themselves here...I have recently rebuilt a Splunk searchhead VM and decided to copy over the $splunk/etc/ file to the new VM to minimize downtime. I was receiving this error and had to go to 'settings>distributed search' and reauthenticate to the indexer.

0 Karma

JDukeSplunk
Builder

My first thought would be SSL negotiation. You might want to check what sslVersions your authentication.conf and server.conf have on the boxes. If the system marking the other "down" only accepts ssl3 and above, but the "down" server is transmitting using ssl2 or ssl1 the receiving server will not be able to negotiate a comm channel with it, and it will fail.

0 Karma

anil1432
Explorer

Hello @JDukeSplunk  ,

Let Me Know What Is The Process  If It fails? , We Might Be  able to Do Any Settings,

0 Karma

adonio
Ultra Champion

hello there,

the question "why it fails?" is probably to product builders / engineers.
would recommend to do what you know needs to be done and match your versions of splunk components.
some answers and articles in the following links:
https://answers.splunk.com/answers/484456/using-different-splunk-version-for-search-head-clu.htmlhtt...
http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Systemrequirements#Compatibility_between_p...

hope it helps

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...