Splunk Enterprise

An error occurred adding 2 indexers with cluster master.

Deshcyber
Observer

ind1.pngind2.pngThe error is  ;- (

Clustering: Peer Node
Tags (2)
0 Karma

Deshcyber
Observer

ok sir. Thank you. Now i have to add more one INDEX ?? indexer 3 right?

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Not index you must add more indexer nodes.

https://docs.splunk.com/Documentation/Splunk/8.2.2/Indexer/Aboutclusters

r. Ismo

isoutamo
SplunkTrust
SplunkTrust

Hi

What are your search and replication factor on your cluster (maybe 2 and 3)? As you have only one node active in this cluster it cannot store enough copies to be a valid state. You must add more nodes to this cluster to get the valid state or reduce both SF and RF to 1 and restart it again.

r. Ismo

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...