hello all, recently i have migrated apps from PROD and DEV to splunk instance and upgraded it to the latest (6.3.2) version. when i open the applications to see the data and the following error can be seen in Messages,
"The searchhead is unable to update the peer information. Error = 'failed method=POST path=/services/cluster/master/generation/4B0F3AB3-035A-4406-A7B3-FBDA998E0C10/?output_mode=json master=server URL rv=0 actual_response_code=400 expected_response_code=200 status_line=Bad Request error=No error' for master=* server URL*"
can anyone help me to get this resolved.
thanks.
Hi japala, Looks like the searchhead is unable to reach the indexers. This could be from a pure network perspective (host is correct, but unreachable), or the configuration is incorrect (dev host trying to reach prod indexer). Investigating the distributed search configuration should probably lead to a resolution for this.
Please let me know if this helps!
Looks like you copied some of the wrong settings in. What is different from your PROD & Dev and this new environment you've "migrated" to?
nothing is different from PROD and DEV. but i dont know i have tried doing everything i can but unable to resolve this issue.
NOTE: before upgrading the instance to 6.3.2 all the apps were working fine and i was able to see the data in the dashboards.
hope this info helps.