Splunk Enterprise

How to push updates from SH deployer and Index Cluster master?

pfabrizi
Path Finder

I had to update a props.conf and I am trying to push it via my Index cluster master and my sh cluster deployer.

what is the command to push from my index cluster?

when I try pushing from SH cluster deployer I get this error:

Error while deploying apps to target=https://txxxxxxx2:8089 with members=2: No captain found amongst members

I used command ./splunk apply shcluster-bundle -target https://txxxxxx2:8089.

THis worked last week when I pushed a new app.

Thanks!

Tags (1)
0 Karma
1 Solution

sudosplunk
Motivator

The error message means, either your SH cluster captain is down or deployer can't talk to the captain. To see your cluster status, run splunk show shcluster-status. If captain is down or undetermined, you can manually assign a captain and set members list by running below command,
Run on new captain: splunk bootstrap shcluster-captain –servers_list https://SH1:8089, https://SH2:8089

To push configurations to indexers from cluster master:
From $SPLUNK_HOME/bin/, run ./splunk apply cluster-bundle -auth admin:<admin_password>

To push configurations to search heads from deployer:
From $SPLUNK_HOME/bin/, run ./splunk apply shcluster-bundle -target <URI>:<management_port> -auth admin:<admin_password>

More admin CLI commands can be found here.

View solution in original post

0 Karma

sudosplunk
Motivator

The error message means, either your SH cluster captain is down or deployer can't talk to the captain. To see your cluster status, run splunk show shcluster-status. If captain is down or undetermined, you can manually assign a captain and set members list by running below command,
Run on new captain: splunk bootstrap shcluster-captain –servers_list https://SH1:8089, https://SH2:8089

To push configurations to indexers from cluster master:
From $SPLUNK_HOME/bin/, run ./splunk apply cluster-bundle -auth admin:<admin_password>

To push configurations to search heads from deployer:
From $SPLUNK_HOME/bin/, run ./splunk apply shcluster-bundle -target <URI>:<management_port> -auth admin:<admin_password>

More admin CLI commands can be found here.

0 Karma

pfabrizi
Path Finder

so when I run ./splunk show shcluster-status on a member it shows me the members and the captain and the members as up. When I try to run this command on my sh master\deployer it tell me search head master in not enabled.

I can see that my apps are under /opt/splunk/etc/shcluster/apps.

any thoughts?

Thank You!

0 Karma

sudosplunk
Motivator

Based on your show cluster-status, it looks like you are getting this message because the captain is actually not a member of the cluster. While member2 and member3 are present in the members list, member1 is not.

Additionally, I would specifically target the captain when running apply shcluster-bundle command. i.e. member1(captain), ./splunk apply shcluster-bundle -target https://captain:8089 -auth admin:<admin_password>

Please try a restart of member1 and see if that prompts a re-election and hopefully have member1 join the cluster successfully. Otherwise run this on new captain, splunk bootstrap shcluster-captain –servers_list https://member1:8089, https://member2:8089, https://member3:8089 to manually assign a captain and set members.

Please let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...