I'm trying to setup a distributed search. I have successfully added my search peers to the search head already.
The issue I have is when I use the web interface of Splunk, for the search head, I see that a few of my search peers have the (Replication status) of (Initial). I am not sure how to get these to have the status of (Successful).
To view my search peers, I went to the following location:
Manager > Distributed search > Search peers
Does anyone have an idea of I still need to do in order to get these statuses to change?
An instance name was incorrect.
Check in slm web -> setting -> console monitoring -> setting-> general setup
or
#opt/splunk/etc/system/local/input.conf in your search head.
I've changed the name of an instance and I'm doing
#splunk resync shcluster-replicated-config on the search head to which you have changed the name.
The error has disappeared for the moment. I'm currently monitoring the situation to see if the problem returns.
I have the same problem and I'm stuck a bit, can someone help me find some ideas?
in the splunk search head web interface => settings => advance settings => distributed search => search peer => the "replication status" column is in "initial" state when it should be successful
when I perform a health check I get a message that tells me "opportunity to move from search head pooling to search head cluster"
disabling then re-enabling the indexer cluster could be a solution. I'm a little afraid of breaking everything by doing this.
Restarting Splunk solved this issue. I'm not sure why my other search peers had a successful status right away.
Need more information. Is there any information in splunkd.log about peer replication? Are there any errors indication a connection or authentication problem?