Hi,
We have disabled [distributedSearch] in out splunk cluster's master and indexer nodes. With this we are seeing below issues
WARN in Master:
WARN DistributedPeerManager - Cannot determine a latest common bundle, search may be blocked
ERROR in Indexers:
SearchPeerBundlesSetup - Cannot find bundles for search peer: <master_ip_node>
What we tried?
- Enabled dist search in master alone(not on indexers) - both issues are gone
- Enabled dist search on all indexers alone(not on master) - Can still see both the issues
- Made an update to one of the apps and did apply-bundle - This is successful without any issues
So the solution seems to be enabling dist search on master. But wanted to get more insight into this.
- What does dist search mean on master and indexers?
- Does master node needs to have dist search enabled?
- In 'Cannot determine a latest common bundle' and 'Cannot find bundles for search peer' what does bundle mean here? I'm sure these are not knowledge bundles.
- Why indexer is treating master as search peer?
