×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
loganac
Engager
Member since: ‎08-13-2020
‎05-31-2023
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 1
Member Since ‎08-13-2020
Topics I've Started
View All

Re: Search Head Cluster - can't add members after ...

by in Deployment Architecture
‎05-31-2023 12:50 PM
1 Karma
‎05-31-2023 12:50 PM
1 Karma
I had this exact issue today and here's what I did: For my issue, the SHC had a static captain. So I followed the Splunk docs to try and get them to become a RAFT distributed consensus voting for the captain. When I ran the commands the SHC cluster broke. After looking around for a while in the conf files I change two things on the non-captain servers. In server.conf, the mgmt_uri was pointing to the existing captain. That has to be its own self per instructions in server.conf and delete the captain_url stanza. After I deleted those I restarted Splunk and ran the command pointed to the captain who was still the cluster splunk add shcluster-member -current_member_uri <URI>:<management_port> I repeated that for the other hosts until the captain was left When I went to the captain I made sure that "mode = member" and deleted the captain_url stanza. When I restarted that host was no longer the captain and another had picked it up. Hope this helps  ... View more

Results page issues after Splunk update

by in Reporting
‎08-13-2020 10:56 AM
‎08-13-2020 10:56 AM
We recently updated our Splunk deployment from 6.5 to 7.3.3. We redeployed our server and indexed everything the exact same as before. Same inputs, props, transforms. But we are having a weird issue with some of our reports being identical as the old ones but then anywhere from 15-30% of the results are all jumbled up. I put an example of what we are seeing below   source     host    testtype  results  measurement c://              1           test1          PASS           00.000125 c://              2            c://            UUT SER:    TUE OP:   The logs haven't change but it's like is not recognizing the props and transforms.conf for some and pushes the information around for our results. I'm still pretty new to Splunk and have tried to find a question similar to this but haven't found any answer. Thanks for the help ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎05-31-2023 04:16 PM
Karma from
View All