Splunk Enterprise

How to push updates from SH deployer and Index Cluster master?

pfabrizi
Path Finder

I had to update a props.conf and I am trying to push it via my Index cluster master and my sh cluster deployer.

what is the command to push from my index cluster?

when I try pushing from SH cluster deployer I get this error:

Error while deploying apps to target=https://txxxxxxx2:8089 with members=2: No captain found amongst members

I used command ./splunk apply shcluster-bundle -target https://txxxxxx2:8089.

THis worked last week when I pushed a new app.

Thanks!

Tags (1)
0 Karma
1 Solution

sudosplunk
Motivator

The error message means, either your SH cluster captain is down or deployer can't talk to the captain. To see your cluster status, run splunk show shcluster-status. If captain is down or undetermined, you can manually assign a captain and set members list by running below command,
Run on new captain: splunk bootstrap shcluster-captain –servers_list https://SH1:8089, https://SH2:8089

To push configurations to indexers from cluster master:
From $SPLUNK_HOME/bin/, run ./splunk apply cluster-bundle -auth admin:<admin_password>

To push configurations to search heads from deployer:
From $SPLUNK_HOME/bin/, run ./splunk apply shcluster-bundle -target <URI>:<management_port> -auth admin:<admin_password>

More admin CLI commands can be found here.

View solution in original post

0 Karma

sudosplunk
Motivator

The error message means, either your SH cluster captain is down or deployer can't talk to the captain. To see your cluster status, run splunk show shcluster-status. If captain is down or undetermined, you can manually assign a captain and set members list by running below command,
Run on new captain: splunk bootstrap shcluster-captain –servers_list https://SH1:8089, https://SH2:8089

To push configurations to indexers from cluster master:
From $SPLUNK_HOME/bin/, run ./splunk apply cluster-bundle -auth admin:<admin_password>

To push configurations to search heads from deployer:
From $SPLUNK_HOME/bin/, run ./splunk apply shcluster-bundle -target <URI>:<management_port> -auth admin:<admin_password>

More admin CLI commands can be found here.

0 Karma

pfabrizi
Path Finder

so when I run ./splunk show shcluster-status on a member it shows me the members and the captain and the members as up. When I try to run this command on my sh master\deployer it tell me search head master in not enabled.

I can see that my apps are under /opt/splunk/etc/shcluster/apps.

any thoughts?

Thank You!

0 Karma

sudosplunk
Motivator

Based on your show cluster-status, it looks like you are getting this message because the captain is actually not a member of the cluster. While member2 and member3 are present in the members list, member1 is not.

Additionally, I would specifically target the captain when running apply shcluster-bundle command. i.e. member1(captain), ./splunk apply shcluster-bundle -target https://captain:8089 -auth admin:<admin_password>

Please try a restart of member1 and see if that prompts a re-election and hopefully have member1 join the cluster successfully. Otherwise run this on new captain, splunk bootstrap shcluster-captain –servers_list https://member1:8089, https://member2:8089, https://member3:8089 to manually assign a captain and set members.

Please let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...