Splunk Search

Search peers / Replication status / Initial

kevinsikora
Explorer

I'm trying to setup a distributed search. I have successfully added my search peers to the search head already.

The issue I have is when I use the web interface of Splunk, for the search head, I see that a few of my search peers have the (Replication status) of (Initial). I am not sure how to get these to have the status of (Successful).

To view my search peers, I went to the following location:

Manager > Distributed search > Search peers

Does anyone have an idea of I still need to do in order to get these statuses to change?

gwen
Loves-to-Learn Lots

An instance name was incorrect.

Check in slm web -> setting -> console monitoring -> setting-> general setup

or

#opt/splunk/etc/system/local/input.conf in your search head.

I've changed the name of an instance and I'm doing

#splunk resync shcluster-replicated-config on the search head to which you have changed the name.

The error has disappeared for the moment. I'm currently monitoring the situation to see if the problem returns.

0 Karma

gwen
Loves-to-Learn Lots

I have the same problem and I'm stuck a bit, can someone help me find some ideas?

in the splunk search head web interface => settings => advance settings => distributed search => search peer => the "replication status" column is in "initial" state when it should be successful

when I perform a health check I get a message that tells me "opportunity to move from search head pooling to search head cluster"

disabling then re-enabling the indexer cluster could be a solution. I'm a little afraid of breaking everything by doing this.

0 Karma

kevinsikora
Explorer

Restarting Splunk solved this issue. I'm not sure why my other search peers had a successful status right away.

araitz
Splunk Employee
Splunk Employee

Need more information. Is there any information in splunkd.log about peer replication? Are there any errors indication a connection or authentication problem?

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...