Installation

Data not found after upgrading to 6.3.2

japala
Path Finder

hello all, recently i have migrated apps from PROD and DEV to splunk instance and upgraded it to the latest (6.3.2) version. when i open the applications to see the data and the following error can be seen in Messages,

"The searchhead is unable to update the peer information. Error = 'failed method=POST path=/services/cluster/master/generation/4B0F3AB3-035A-4406-A7B3-FBDA998E0C10/?output_mode=json master=server URL rv=0 actual_response_code=400 expected_response_code=200 status_line=Bad Request error=No error' for master=* server URL*"

can anyone help me to get this resolved.

thanks.

Labels (3)
0 Karma

muebel
SplunkTrust
SplunkTrust

Hi japala, Looks like the searchhead is unable to reach the indexers. This could be from a pure network perspective (host is correct, but unreachable), or the configuration is incorrect (dev host trying to reach prod indexer). Investigating the distributed search configuration should probably lead to a resolution for this.

Please let me know if this helps!

0 Karma

jkat54
SplunkTrust
SplunkTrust

Looks like you copied some of the wrong settings in. What is different from your PROD & Dev and this new environment you've "migrated" to?

0 Karma

japala
Path Finder

nothing is different from PROD and DEV. but i dont know i have tried doing everything i can but unable to resolve this issue.
NOTE: before upgrading the instance to 6.3.2 all the apps were working fine and i was able to see the data in the dashboards.
hope this info helps.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...