Splunk Dev

questions about splunk apply shcluster-bundle running a long time and eventually failed

lim2
Communicator

questions about splunk apply shcluster-bundle running a long time and eventually failed because of "Connection reset by" from Splunk deployer server.
Splunk 7.1.5. SH Cluster of 4 servers on AWS Linux
As a result I'm getting:
/opt/splunk/bin/splunk show shcluster-status
Splunk username: admin
Password:

Encountered some errors while trying to obtain shcluster status.
This node is not the captain of the search head cluster, and we could not determine the current captain. The cluster is either in the process of electing a new captain, or this member hasn't joined the pool

Found that splunk was not running on the SH Cluster captain and that 1 SH server was not responding to ssh
1) How to get the " splunk apply shcluster-bundle" command to provide more verbose feedback?
2) Like what SH server the bundle is being pushed to and what the % completion?
3) Any errors like SH server not reachable.
Luckily I was doing this in my test env, but how could the command be more smoothly ran?
Thanks

Tags (1)
0 Karma

skalliger
Motivator

You might want to use the Monitoring Console for analysing the details further. The MC comes with some nice dashbaords giving you an insight into your deployment, including deployment bundle sizes and how long it took to deploy.

A connection reset could have several root causes and without further logs, this is hard to isolate.

Skalli

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...