I had the same issue, this is how I reserved my issue: On searchhead(s) in /opt/splunk/etc/system/local/server.conf [shclustering] disabled = 0 mgmt_uri = https://10.0.0.202:8089 replication_factor = 2 shcluster_label = InCorpShcluster01 id = 33DA70FF-FC57-497A-B405-CA85C61EFACE adhoc_searchhead = true current_member_uri = https://10.0.0.135:8089 I had the DEPLOYER = xxxxx under the[shcluster]stanza , but read that the KEYc ould be located under the [general] stanza - so I removed the pass4SymmKey = and restarted splunk. Deployer /opt/splunk/etc/system/local/server.conf [general]serverName = searchhead2site1 pass4SymmKey = $7$v9H1PDth+5OR0zCD4fnfJOJ8JQ7/sdJd6+vc/jSDRX0v4suiha+Srg== ## bunch of other line configs [shclustering] shcluster_label = InCorpShcluster01 Deployer server ------------------------------------------ [splunk@deployer]lunk/bin/splunk apply shcluster-bundle -target https://10.0.0.202:8089 -auth admin:pssword Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members. Please refer to the documentation for the details. Do you wish to continue? [y/n]: y Bundle has been pushed successfully to all the cluster members.
... View more