About awilliams_splun

awilliams_splun · ‎02-13-2017

How do you have a two peer SHC? At least 3 Search heads are required.

awilliams_splun · ‎04-20-2015

As I stated before my cluster was running in "Mixed Mode". When running in mixed mode the following setting needs to be set in the server.conf file on the cluster master: use_batch_mask_changes = false After changing this setting and restarting the Cluster Master, all the indexes showed as fully searchable. This is actually documented as a required change when running in mixed mode. http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Systemrequirements

awilliams_splun · ‎04-20-2015

I’m running a mixed cluster where my CM is 6.2.2 and my indexer peers are all running 6.1.4. One of the peers in the cluster crashed which resulted in my search and replication factors to both be off. I could see fixup was running on the indexes so I gave it sometime to complete. After a day i reviewed the status of the indexes in SOS and fixup showed that it was successfully run on all the indexes. Checked the Indexer Clustering view and both the search and replication factors showed as being met. However, non of the indexes were showing as "Fully Searchable". I gave it more time to complete. Still no change. I then performed a complete restart of the cluster. Still no change. The logs showed that all was good in the cluster. Why won’t the cluster show as fully searchable?

awilliams_splun · ‎03-12-2015

This happens when the cluster master can not validate the app bundle that it is trying to push to the peer. This results in the initial app bundle from failing to get added to the cluster peer so the CM never adds the peer to the cluster. This can be resolved by connecting to the CM via CLI and typing the following command: ./splunk apply cluster-bundle --skip-validation This will force the CM to push the app bundle and the peer come back to life.

awilliams_splun · ‎03-12-2015

Having a problem joining an indexer already in use to my cluster. This indexer is currently running as a standalone instance. I'm trying to standup a clustered environment and want to add this indexer as a member to the cluster. I built the cluster master (CM) and it's working fine. When I try to add my indexer to the cluster it fails. The indexer will get stuck in a hung state. If I view the server.conf file of the peer, I can see the clustering information was added correctly to the indexer's /local/server.conf file. However, the peer will not be listed in the clustering view on the CM. The peer is just hung. I can't log into the peer through splunkweb. When I try, it will give an error that splunkweb can not communicate with splunkd. The only way I can get the peer back is by removing the clustering information from /local/server.conf . If I build another instance of Splunk on the same hardware as the one failing, that system will join the cluster and come up just fine. Here are the entries in the splunkd.log file of the CM. 02-26-2015 15:31:37.193 -0500 INFO CMBundleMgr - Downloaded bundle to /opt/splunk/var/run/splunk/cluster/remote-bundle/9e5648b83b7b2b5b1a0195316e3d8205-1424982697.bundle 02-26-2015 15:31:37.193 -0500 INFO CMBundleMgr - untarring bundle=/opt/splunk/var/run/splunk/cluster/remote-bundle/9e5648b83b7b2b5b1a0195316e3d8205-1424982697.bundle 02-26-2015 15:31:37.196 -0500 INFO ClusterBundleValidator - Validating bundle path=/opt/splunk/var/run/splunk/cluster/remote-bundle/9e5648b83b7b2b5b1a0195316e3d8205-1424982697/apps 02-26-2015 15:31:37.221 -0500 INFO CMBundleMgr - Removed the untarred bundle folder=/opt/splunk/var/run/splunk/cluster/remote-bundle/9e5648b83b7b2b5b1a0195316e3d8205-1424982697 02-26-2015 15:31:37.221 -0500 INFO CMBundleMgr - Removed the bundle downloaded from master to '/opt/splunk/var/run/splunk/cluster/remote-bundle/9e5648b83b7b2b5b1a0195316e3d8205-1424982697.bundle'

awilliams_splun · ‎01-26-2015

Yes, a minimum of 3 systems is required for SH Clustering. This is largely do to the SH Cluster captain election process. In SH cluster the SH cluster has what is called a Captain. The captain is used to coordinate activities across the SH Cluster to include: Schedule jobs across the cluster Push knowledge bundles to peers Replicate the various search artifacts to peers Replicate any configuration changes made to peers (the use of deployer server is required for config changes. system side config changes should not be made locally) Coordinating alerts etc When the system is brought up for the first time or the scheduled/unscheduled restart of the captain, a election process occurs to elect a new captain. This election process requires a 51% majority vote from all members in the cluster. This would not be achievable in a two node cluster.

awilliams_splun · ‎01-16-2015

Are you getting this error in a SH cluster? I've noticed this error myself in my test environment. I'm using a deployer server to push updates to my SHC and have noticed that the dropdowns.csv file gets removed. If I redeploy the apps to the SHC the file returns and the errors go away.

Posts	7
Solutions	2
Karma Given	10
Karma Received	24
Member Since	‎04-09-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Replicated indexes not fully searchable - Mixed Cl...

Why am I unable to add a currently running standal...

Re: What does status=delegated_remote OR status=de...

Re: Replicated indexes not fully searchable - Mixe...

Replicated indexes not fully searchable - Mixed Cl...

Re: Why am I unable to add a currently running sta...

Why am I unable to add a currently running standal...

Re: What is recommended for migrating from my curr...

Re: Why am I getting "The lookup table 'dropdownsL...