Splunk Enterprise

DistributedPeerManager - Cannot determine a latest common bundle, search may be blocked Error on master node

vtalanki
Path Finder

Hi,

We have disabled [distributedSearch] in out splunk cluster's master and indexer nodes. With this we are seeing below issues

WARN in Master:

 

WARN  DistributedPeerManager - Cannot determine a latest common bundle, search may be blocked

 


ERROR in Indexers:

 

SearchPeerBundlesSetup - Cannot find bundles for search peer: <master_ip_node>

 


What we tried?

  1. Enabled dist search in master alone(not on indexers) - both issues are gone
  2. Enabled dist search on all indexers alone(not on master) - Can still see both the issues
  3. Made an update to one of the apps and did apply-bundle - This is successful without any issues

So the solution seems to be enabling dist search on master.  But wanted to get more insight into this.

  1. What does dist search mean on master and indexers?
  2. Does master node needs to have dist search enabled?
  3. In 'Cannot determine a latest common bundle' and 'Cannot find bundles for search peer' what does bundle mean here? I'm sure these are not knowledge bundles. 
  4. Why indexer is treating master as search peer? 
Labels (1)
0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk &#43; Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...