In searchhead cluster with six machines, only one SH machine is not giving results for a particular app.

[Reethika]

In searchhead cluster with six machines, only one SH machine is not giving results for a particular app.

We have checked right corner>help>about>server.

All 5 other SH's giving results for this dashboard, except one.

Could anyone suggest with some troubleshooting?

I have cross-checked app config, among SHM 

Thanks.

[Reethika]

The searchhead is unable to update the peer information. Error = 'Master has multisite enabled but the search head is missing the 'multisite' attribute.' for master=https://************************ : 8089.

This is the  error I see on that particular SH 

[sylim_splunk]

Make sure to have "site = <site>"  you can compare the server.conf with working SHs.

[richgalloway]

Make sure the multisite attribute is set in the server.conf files on your search heads.

[Reethika]

[clustering]
master_uri = https://1*****************:8089
mode = searchhead
multisite = true
pass4SymmKey=*******************

Multisite is true

[Reethika]

It's an Enterprise security app,  And a particular dashboard "Incident Review" is give error as "Search did not return any events." on one SH.

On other searchhead we are getting results. 

[sylim_splunk]

What do you get on the GUI for the search. Do you find any error on the screen?

Is the search head able to do any searches but the search in question? Check the job inspector .

[richgalloway]

What is the app?  What is it supposed to be doing?  Is it enabled on all SHs?  What are the expected results?  Have you checked the logs?

[Reethika]

@richgalloway @anilchaithu  @sylim_splunk 

Can you please help