Search peers / Replication status / Initial

[kevinsikora]

I'm trying to setup a distributed search. I have successfully added my search peers to the search head already.

The issue I have is when I use the web interface of Splunk, for the search head, I see that a few of my search peers have the (Replication status) of (Initial). I am not sure how to get these to have the status of (Successful).

To view my search peers, I went to the following location:

Manager > Distributed search > Search peers

Does anyone have an idea of I still need to do in order to get these statuses to change?

[gwen]

An instance name was incorrect.

Check in slm web -> setting -> console monitoring -> setting-> general setup

or

#opt/splunk/etc/system/local/input.conf in your search head.

I've changed the name of an instance and I'm doing

#splunk resync shcluster-replicated-config on the search head to which you have changed the name.

The error has disappeared for the moment. I'm currently monitoring the situation to see if the problem returns.

[gwen]

I have the same problem and I'm stuck a bit, can someone help me find some ideas?

in the splunk search head web interface => settings => advance settings => distributed search => search peer => the "replication status" column is in "initial" state when it should be successful

when I perform a health check I get a message that tells me "opportunity to move from search head pooling to search head cluster"

disabling then re-enabling the indexer cluster could be a solution. I'm a little afraid of breaking everything by doing this.

[kevinsikora]

Restarting Splunk solved this issue. I'm not sure why my other search peers had a successful status right away.

[araitz]

Need more information. Is there any information in splunkd.log about peer replication? Are there any errors indication a connection or authentication problem?