Splunk Search

Search peers / Replication status / Initial

kevinsikora
Explorer

I'm trying to setup a distributed search. I have successfully added my search peers to the search head already.

The issue I have is when I use the web interface of Splunk, for the search head, I see that a few of my search peers have the (Replication status) of (Initial). I am not sure how to get these to have the status of (Successful).

To view my search peers, I went to the following location:

Manager > Distributed search > Search peers

Does anyone have an idea of I still need to do in order to get these statuses to change?

gwen
Loves-to-Learn Lots

An instance name was incorrect.

Check in slm web -> setting -> console monitoring -> setting-> general setup

or

#opt/splunk/etc/system/local/input.conf in your search head.

I've changed the name of an instance and I'm doing

#splunk resync shcluster-replicated-config on the search head to which you have changed the name.

The error has disappeared for the moment. I'm currently monitoring the situation to see if the problem returns.

0 Karma

gwen
Loves-to-Learn Lots

I have the same problem and I'm stuck a bit, can someone help me find some ideas?

in the splunk search head web interface => settings => advance settings => distributed search => search peer => the "replication status" column is in "initial" state when it should be successful

when I perform a health check I get a message that tells me "opportunity to move from search head pooling to search head cluster"

disabling then re-enabling the indexer cluster could be a solution. I'm a little afraid of breaking everything by doing this.

0 Karma

kevinsikora
Explorer

Restarting Splunk solved this issue. I'm not sure why my other search peers had a successful status right away.

araitz
Splunk Employee
Splunk Employee

Need more information. Is there any information in splunkd.log about peer replication? Are there any errors indication a connection or authentication problem?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...