Seeing refactor error message on peer nodes in one of three Splunk instances.


We are Splunk partner.

I build one lab in our environment.
In that lab, I have three indexers, one cluster master, one heavy forwarder, and one search head.

I have some questions in my mind.

Initially, I configure index clustering with the above resources (3 indexers and one cluster master)

Two are integrated successfully, the third one is not integrating.
I am seeing refactor error message on peer nodes.

Please advise me on this.

Labels (4)
Tags (1)
0 Karma


Yeah Thats because cluster is waiting for one more indexer to join , that is the reason you are seeing those message .


I tried to join third peer but it is giving me key error.

0 Karma


Can you check your pass4symmkey attribute value.Make sure you are not copied junk character from any text editor.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!