Monitoring Splunk

I just setup a search head deployer in docker and i am getting the below error on all three search heads.

enmanu
New Member

10-17-2018 03:54:47.137 +0000 WARN ConfReplication - downloadDeployableApps: Got zero-size baseline configuration
10-17-2018 03:54:47.137 +0000 WARN ConfReplication - downloadDeployableApps: Error listing baseline configuration: Non-200/201 status_code=401; {"messages":[{"type":"ERROR","text":"Unauthorized"}]}
10-17-2018 03:54:47.036 +0000 WARN ConfReplication - downloadDeployableApps: Waiting 100ms ...
10-17-2018 03:54:47.036 +0000 WARN ConfReplication - downloadDeployableApps: Error listing baseline configuration: Non-200/201 status_code=401; {"messages":[{"type":"ERROR","text":"Unauthorized"}]}
10-17-2018 03:54:46.935 +0000 WARN ConfReplication - downloadDeployableApps: Waiting 100ms ...
10-17-2018 03:54:46.935 +0000 WARN ConfReplication - downloadDeployableApps: Error listing baseline configuration: Non-200/201 status_code=401; {"messages":[{"type":"ERROR","text":"Unauthorized"}]}

Tags (1)
0 Karma

akandi
Loves-to-Learn

Following could be possible reason for this error:

1) secret key between deployer and cluster members are not same.
2) Make sure each member on search head cluster have different server name. In case server name is same with any member then it will give this error.

0 Karma

MuS
Legend

Hi enmanu,

Indeed it is a permission problem, but not one you're thinking of 😉

The problem is most likely caused by a mismatching pass4SymmKey and is described in the docs here http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/PropagateSHCconfigurationchanges#Set_a...

If you're 100% sure the keys match, read this answer which provides a lot of information about troubleshooting a SHC https://answers.splunk.com/answers/242905/shc-troubleshooting-configurations-under-search-he.html

Hope this helps ...

cheers, MuS

0 Karma

skalliger
Motivator

Looks like a permission problem. Did you check permisisons on directories are set correctly?

0 Karma

enmanu
New Member

Thank you for your response. I have checked the permissions. The error wont go away

0 Karma

yamila123
Loves-to-Learn

did you ever get this resolved?  I am experiencing the same issue and wondering if you had figured out a solution

0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...