Splunk Enterprise Security

How to enable master node on all indexers ?

90509
Engager

Hi All ,

I am working in cluster environment with 16 prod indexers, and one separate cluster master node.

if I run /opt/splunk/bin/splunk list cluster-peers

if i run the above command in master node command prompt which showing all indexers in the cluster but if run same command on any of the indexers showing master node not enabled.
how to enable master node on each indexer . this case came while synch or pairing indexer with master node.

How to enable master node on all indexers with command line prompt.

0 Karma

codebuilder
SplunkTrust
SplunkTrust

This is well documented, but here is the short answer.

Assuming you have already set a pass4SymmKey in the [clustering] stanza on the master, these are the commands you want to run on each of the indexers/peers:

 /opt/splunk/bin/splunk edit cluster-config -mode slave -master_uri https://xx.xxx.xx.xxx:8089 -replication_port 9887 -secret your_key_here

/opt/splunk/bin/splunk restart

Obviously substituting in your master's IP and pass4SymmKey value (in plain text, not the hashed version).

However, I don't personally like this method as it leaved behind the secret in the command history. It's more secure to update server.conf and cycle Splunk, but you asked specifically about the CLI method.

https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/ConfigurepeerswithCLI

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

90509
Engager

could you please let me know the reason why it happened . all are in cluster environment with master node if we check from master node to all indexers are in state UP condition but if we check from indexer master node not enabled why this was coming .

one more question i would like to ask , if we ping from master node to indexer the data packets are sending but we check from indexer to master node showing "unknown host" , is it bidirectional or single direction....

0 Karma

codebuilder
SplunkTrust
SplunkTrust

If the master shows all peers are "up" then your cluster is healthy.

Running "/opt/splunk/bin/splunk list cluster-peers" is only valid from the master, it is not run on the peers.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...