Unable to login to splunk cluster master web after changing my cluster master.

[Mayurmpatil]

I followed the following steps:

1) stop first cluster master
2) change master_uri from old ip address to new ip address in server.conf of indexers and search head.
3) Install new instance of different server
3) copy [general] , [clustering] , [sslConfig] from old cluster master to new splunk instance
4) start new splunk instance

When I did this , I am unable to login to console . I can hit https://:8000 , but when I give my credentials it gives 500 error..

500 Internal Server Error

Oops.
Click here to return to Splunk homepage.

Also cli commands like ./splunk help cluster-bundle are not giving any response .
Is anyone aware what might have went wrong?

[renjith_nair]

Hi @Mayurmpatil ,

Somehow your web server is not able to connect to splunkd. Its worth to check your web.conf to make sure that the IPs are configured properly and there are no left overs from old server especially mgmtHostPort = <IP:port>.

Also look at your server.conf for any stale information. This should help you to get a login to master web and then you could troubleshoot the rest of the issues.

Refer here for more information : http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Handlemasternodefailure

[harsmarvania57]

Hi @Mayurmpatil,

Have you copied encrypted password from old cluster master to new cluster master in [general] , [clustering] , [sslConfig] stanza ? If so then it will not work until and unless you copied splunk.secret from old cluster master to new cluster master. If you have not copied splunk.secret in that case provide plain text password in server.conf and restart splunk service it will automatically encrypt password.

Thanks,
Harshil