Splunk Search

Captain Skipping Configuration Replication


Hi guys,

I'm having a problem with my environment, we have 15 machines, 1 Master, 1 Deploy, 1 Universal Forwarder, 6 Search Head, 5 Indexers. The message below begin to appear in my search heads.

The search head cluster captain (https://server0011:8089) is disconnected; skipping configuration replication

We have replication factor of 1 to 3.

What can be ?


This usually happens to me when the cluster master goes down for whatever reason.

Try running 'splunk status' on the captains command line. Then perhaps you'll fine a 'splunk start' is in order.

0 Karma


I would suggest looking at your conf.log for "data.worklog{}.status”=STOPONMISSINGLOCALBASELINE

This would tell you if there are potential out of sync nodes from the clusters' captain. I see that these messages automatically disappear. Would that mean the node has dropped its captaincy and after re-synced to the new captains bundle?

0 Karma

New Member

We are experiencing this issue. Any solution?

0 Karma

Path Finder

we have the same problem did you find a solution?

0 Karma