Monitoring Console (MC) not recognizing Search Head Cluster (SHC) Label

[sloshburch]

I'm guessing I'm overlooking something obvious here, so reaching out to the community for an extra set of eyes.

I have the label set on the shcluster_label set on the deployer but the "Search Head Cluster(s)" column in the MC Setup never shows the label. As such, I get the warning that "This instance is a search head deployer without a search head cluster label. We recommend you edit this instance to set its search head cluster label."

I even set the shcluster_label in $SPLUNK_HOME/etc/system/local/server.conf. It matches the value on the SHC members. Btool shows it loading correctly. Deployer and SHC members all show site = site0 (as desired).

I even tried the instructions on http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCconfigurationoverview#Set_the_searc... for post setting the label after building the cluster.

Am I overlooking something? Anyone see anything I'm not?

[mustapha_arakji]

Same issue here. Even after "Apply Changes" still getting the warnings.

I managed to fix it from Monitoring Console > General Setup > Edit > "Disable Monitoring", then "Enable Monitoring" for each search head and the deployer! (make sure to review the roles after you do this step).

[jawaharas · Accepted solution]

This worked for me.

In the Splunk Monitoring Console app,

Navigate to Settings -> General setup
Click Edit -> Edit Instance on 'SHC Deployer' instance's entry
Enter the Search Head Cluster's label in the pop-up window and save.

Below warning won't appear after that.

"At least one of your instances is a search head deployer without a search head cluster label"

[sloshburch]

What release are you on? It works for me on 7.3 so maybe it's now fixed.

[jawaharas]

We are using 7.1.1

[ghantk1]

Most often this is fixed by apply changes and you have proper roles. Check the permissions on assets.csv under $SPLUNK_HOME/etc/apps/splunk_monitoring_console/lookups and also doublecheck to see if the entry for shcluster exists in the assets.csv.

[sloshburch]

I've opened a ticket for this one.

[rrthokala]

What was the solution for this?

[sloshburch]

No update yet. A work effort for the fix is in the queue and I used your query to ask for an update.

[Robbie1194]

Was a solution ever found for this because I'm getting the exact same issue.

[sloshburch]

Not yet. I'm checking again with the product team 😞

[ypeng_splunk]

Any solution from the ticket?

[sloshburch]

Nothing told to me. But I'll pester again.

[ypeng_splunk]

I remember it was alright when I did the same based on v7.2.0 weeks ago. Today, I got the same issue reported by one of my friends for v7.2.3. Just add more info here. I will built a docker cluster soon to see what's going on.

[mattymo]

Have you tried the magic "apply settings/changes" in General Setup of the MC to see if it will take the settings?

[sloshburch]

🙂 It's actually once you apply such config that these messages present themselves. So, yea, I tried that but no luck.

[woodcock]

This is the universe's way of telling you "Seach Head Clustering is bad mojo; turn back now or forever be filled with regret!"

[sloshburch]

Oh you silly goose.