Monitoring Splunk

search head cluster error??

AzmathShaik
Path Finder

Hello

i am deploy new search head cluster, the deployment went successful but when i check the splunkd.log i fount one strange warning
04-08-2017 03:46:21.294 +0000 WARN ConfReplicationBookmark - serializeToJson: tried to serialize an empty bookmark
04-08-2017 03:46:21.294 +0000 WARN SHCHouseKeepingThread - writeSHCStateToStateStore: failed to serialize the bookmark

i am curious to know about this. what does it exactly means and is this a harmful warning?
do i face issues with this warning?

can some help me ?

Thanks in advance

0 Karma
1 Solution

AzmathShaik
Path Finder

some how i figured out the problem. the issue was with the kvstore port (8191). firewall rule was blocking it. the captain was unable to connect to other nodes and write to kvstore

View solution in original post

AzmathShaik
Path Finder

some how i figured out the problem. the issue was with the kvstore port (8191). firewall rule was blocking it. the captain was unable to connect to other nodes and write to kvstore

Masa
Splunk Employee
Splunk Employee

It indicates this Splunk instance could not understand SHC node status. I suspect you cannot see SHC status (splunk show shcsluter-status) in this node when the message was generated. I also suspect your conf replication is failing.

In that case, you might need to run destructive resync command to resolve the issue. You should make a backup of etc directory before running the command.

You said a new search head cluster. Are those Search head instances new ? If so, do you have three or more search heads? Please make sure you meet requirement to deploy a new SHC.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...