Unable to add new indexer to cluster

[SplunkNinja]

I have a new Splunk indexer and want to add it to my indexer cluster.  I am getting the following Warning in the logs of the new indexer:

09-16-2025 18:31:10.729 +0000 WARN CMMasterProxy [6710 MainThread] - The cluster manager is down! Make sure pass4SymmKey is matching if the cluster manager is running.  

I decrypted the Pass4Symmkey on my other indexers and made sure to add it to the new indexer server.conf file.  I restarted Splunk but I still see the same Warning and Splunk will not start on the new indexer.

Here is the new server.conf

[replication_port://9887]

[clustering]
mode = peer
manager_uri = https://w.x.y.z:8089
pass4SymmKey = xxx
cluster_label = IDX_CLUSTER

[sslConfig]
sslPassword = xxx

[general]
pass4SymmKey = xxx

 Note: xxx above is the encrypted values on the system

[PickleRick]

This is just one of the possible reasons.

Check the usual suspects:

- network connectivity

- typos (typical mistake is wrong case or too few ems in pass4SymmKey)

- SELinux

[livehybrid]

Hi @SplunkNinja 

Are you able to confirm you can reach the CM using curl from your new indexer? 

Are there any other cert/SSL settings which need to be migrated to the new indexer (e.g. for example to trust the CA of the CM from your new indexer?)

Do you get the same decrypted pass4SymmKey when you decode from multiple existing indexers?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[SplunkNinja]

Yes - I was able to curl to the CM.  And I have the same decrypted pass4SymmKey.  I believe the issue was related to missing certs/SSL settings as you mention.  I was able to get this working.  Thanks.