- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to install a fresh install of Enterprise Security onto a search head cluster.
I uploaded the app via the GUI onto the shc deployer, but before I click start configuration process, I note the following message:
Splunk Enterprise Security is being configured on a single search head deployment.
How do I get it to recognize it is a search head cluster deployer?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ran into this same problem today. The short version is that the deployer's server.conf file needs a value for "pass4SymmKey" value in the [shclustering] stanza in order for the E.S. setup to detect that a Splunk instance is a Search Deployer (even though technically a Deployer doesn't seem to actually need this value explicitly set).
If you care for more technical detail:
Tracing backwards, you probably saw something like this in the logs:
2022-04-04 21:44:51,916+0000 INFO pid=85111 tid=MainThread file=ess_configured_handler.py:handle_ssl:230 | Standalone SH detected
Digging into /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/ess_configured_handler.py, you find the code:
def is_shc_deployer(session_key):
'''
Determine whether we are on a SHC deployer
'''
unused_r, c = rest.simpleRequest(
'configs/conf-server/shclustering', # noqa: X101
sessionKey=session_key,
getargs={'output_mode': 'json'},
raiseAllErrors=True
)
c = json.loads(c)['entry'][0]['content']
if c.get('pass4SymmKey'):
return True
return False
... so your server.conf file should have:
[shclustering]
pass4SymmKey=xxx
... in order for the auto-detection to work the way you'd expect in E.S.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ran into this same problem today. The short version is that the deployer's server.conf file needs a value for "pass4SymmKey" value in the [shclustering] stanza in order for the E.S. setup to detect that a Splunk instance is a Search Deployer (even though technically a Deployer doesn't seem to actually need this value explicitly set).
If you care for more technical detail:
Tracing backwards, you probably saw something like this in the logs:
2022-04-04 21:44:51,916+0000 INFO pid=85111 tid=MainThread file=ess_configured_handler.py:handle_ssl:230 | Standalone SH detected
Digging into /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/ess_configured_handler.py, you find the code:
def is_shc_deployer(session_key):
'''
Determine whether we are on a SHC deployer
'''
unused_r, c = rest.simpleRequest(
'configs/conf-server/shclustering', # noqa: X101
sessionKey=session_key,
getargs={'output_mode': 'json'},
raiseAllErrors=True
)
c = json.loads(c)['entry'][0]['content']
if c.get('pass4SymmKey'):
return True
return False
... so your server.conf file should have:
[shclustering]
pass4SymmKey=xxx
... in order for the auto-detection to work the way you'd expect in E.S.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
@TheBravoSierra - Please make sure that you followed all pre-requisites for SHC and ES on SHC. (ex. forwarding logs, setting shclustering stanza on deployer, etc etc)
https://docs.splunk.com/Documentation/ES/7.0.1/Install/InstallEnterpriseSecuritySHC
![](/skins/images/5D2DD17C284106BFBF80528D01D8AA1A/responsive_peak/images/icon_anonymous_message.png)