Hi Dev_Choudhary, Is your issue resolved? If your issue is resolved, can you share the cause/resolution with us? If you are still facing the issue can you provide the answers to below questions: 1. What Addon version you are using? 2. Have you changed any access rights of existing roles like admin/user/power/splunk-system-role? 3. Can you access Splunk management port URL from the browser with admin credentials? (example: https://:8089) 4. Also, can you post the contents of Addon's inputs.conf of local? (If any sensitive information is there you can asterisk it before posting.) Thanks, Archana ... View more

Kindly tear down whole search head clustering setup. Edit server.conf in $SPLUNK_HOME/etc/system/local and remove [shclustering] and [replication_port] stanza from each search head and restart them. Also remove [shclustering] stanza from server.conf on deployer in $SPLUNK_HOME/etc/system/local and restart. In my case I first followed above steps and then did whole clustering setup and it worked. don't forget to restart search heads and deployer after tearing the setup. I hope this helps. ... View more

There is mistake in your CLI which you are running on search head. Try this replace admin:changed by your Splunk credentials /opt/splunk/bin/splunk bootstrap shcluster-captain -servers_list "https://splunk1.acml.com:8089,https://splunk2.acml.com:8089,https://splunk3.acml.com:8089" -auth admin:changed Refer follow document http://docs.splunk.com/Documentation/Splunk/6.2.4/DistSearch/SHCdeploymentoverview point 5 Bring up the cluster captain I hope this helps ... View more