You are right, it is "bootstrap" - in my initial answer I typed "bootstart." I could blame autocorrect, but it is probably my own typing...
Was there an error when you did the init command? It should have looked like
splunk init shcluster-config -mgmt_uri https://thisSH:port -replication_port 9999
–secret shclusterpwd
Where
"thisSH:port" is the name/IP and splunkd port number of the current search head,
"9999" is the number of the replication port for the search head cluster, and
"shclusterpwd" is the password for the search head cluster.
If you are not sure if there was an error, you might want to look at the splunkd.log in the var/log/splunk directory under your Splunk installation directory.
After you have run the "init" command on each of the search heads, you can run the bootstrap command on one of the search heads only. Run the following on the server that you want to become the initial captain
splunk bootstrap shcluster-captain
–servers_list https://SH1:port,https://SH2:port,https://SH3:port
Where SH1, SH2 and SH3 are the search heads in the cluster (including the captain) with their splunkd ports.
[And of course these commands should be typed on a single line, although they break into multiple lines here...]
Finally, what OS are you using for your search heads?
... View more
