Splunk Enterprise

DistributedPeerManager - Cannot determine a latest common bundle, search may be blocked Error on master node

vtalanki
Path Finder

Hi,

We have disabled [distributedSearch] in out splunk cluster's master and indexer nodes. With this we are seeing below issues

WARN in Master:

 

WARN  DistributedPeerManager - Cannot determine a latest common bundle, search may be blocked

 


ERROR in Indexers:

 

SearchPeerBundlesSetup - Cannot find bundles for search peer: <master_ip_node>

 


What we tried?

  1. Enabled dist search in master alone(not on indexers) - both issues are gone
  2. Enabled dist search on all indexers alone(not on master) - Can still see both the issues
  3. Made an update to one of the apps and did apply-bundle - This is successful without any issues

So the solution seems to be enabling dist search on master.  But wanted to get more insight into this.

  1. What does dist search mean on master and indexers?
  2. Does master node needs to have dist search enabled?
  3. In 'Cannot determine a latest common bundle' and 'Cannot find bundles for search peer' what does bundle mean here? I'm sure these are not knowledge bundles. 
  4. Why indexer is treating master as search peer? 
Labels (1)
0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...