Splunk Enterprise

How to push updates from SH deployer and Index Cluster master?

pfabrizi
Path Finder

I had to update a props.conf and I am trying to push it via my Index cluster master and my sh cluster deployer.

what is the command to push from my index cluster?

when I try pushing from SH cluster deployer I get this error:

Error while deploying apps to target=https://txxxxxxx2:8089 with members=2: No captain found amongst members

I used command ./splunk apply shcluster-bundle -target https://txxxxxx2:8089.

THis worked last week when I pushed a new app.

Thanks!

Tags (1)
0 Karma
1 Solution

sudosplunk
Motivator

The error message means, either your SH cluster captain is down or deployer can't talk to the captain. To see your cluster status, run splunk show shcluster-status. If captain is down or undetermined, you can manually assign a captain and set members list by running below command,
Run on new captain: splunk bootstrap shcluster-captain –servers_list https://SH1:8089, https://SH2:8089

To push configurations to indexers from cluster master:
From $SPLUNK_HOME/bin/, run ./splunk apply cluster-bundle -auth admin:<admin_password>

To push configurations to search heads from deployer:
From $SPLUNK_HOME/bin/, run ./splunk apply shcluster-bundle -target <URI>:<management_port> -auth admin:<admin_password>

More admin CLI commands can be found here.

View solution in original post

0 Karma

sudosplunk
Motivator

The error message means, either your SH cluster captain is down or deployer can't talk to the captain. To see your cluster status, run splunk show shcluster-status. If captain is down or undetermined, you can manually assign a captain and set members list by running below command,
Run on new captain: splunk bootstrap shcluster-captain –servers_list https://SH1:8089, https://SH2:8089

To push configurations to indexers from cluster master:
From $SPLUNK_HOME/bin/, run ./splunk apply cluster-bundle -auth admin:<admin_password>

To push configurations to search heads from deployer:
From $SPLUNK_HOME/bin/, run ./splunk apply shcluster-bundle -target <URI>:<management_port> -auth admin:<admin_password>

More admin CLI commands can be found here.

0 Karma

pfabrizi
Path Finder

so when I run ./splunk show shcluster-status on a member it shows me the members and the captain and the members as up. When I try to run this command on my sh master\deployer it tell me search head master in not enabled.

I can see that my apps are under /opt/splunk/etc/shcluster/apps.

any thoughts?

Thank You!

0 Karma

sudosplunk
Motivator

Based on your show cluster-status, it looks like you are getting this message because the captain is actually not a member of the cluster. While member2 and member3 are present in the members list, member1 is not.

Additionally, I would specifically target the captain when running apply shcluster-bundle command. i.e. member1(captain), ./splunk apply shcluster-bundle -target https://captain:8089 -auth admin:<admin_password>

Please try a restart of member1 and see if that prompts a re-election and hopefully have member1 join the cluster successfully. Otherwise run this on new captain, splunk bootstrap shcluster-captain –servers_list https://member1:8089, https://member2:8089, https://member3:8089 to manually assign a captain and set members.

Please let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...