So I have a vSphere environment.  our indexer machines are running rhel 8.7 and I installed splunk enterprise on all them. We named them indx01, indx02 and indx03 real creative yep but with some googling we turning off distributed searching and disabled firewall just to be sure we initially had a success in adding peers to the index cluster master, but they were throwing an error that said unable to connect to the cluster master and so on the replication factor blah blah. So then we disabled indexer clustering on all of them and now I can't get any of them to be added. Distributed search turned off check firewall disabled   check on the same domain and dns  check I am attaching a image of a warning but I don't know what if anything it has to do with the problem ... View more

Does the indexer cluster have to be http? ... View more

just trying to figure out why its gives that warning? ... View more

  This is after a restart from a windows vm that I installed the forwarder on and I put info in the outputs.conf   this is my outputs.conf file i tried to make it the same for windows and linux currently box 1 is linux vm and box 2 is windows vm Ihave alled traffic on 8089,9997 and so on i can ping linux host and what I believe to be the ip of splunk. so first question is whats that error telling me (what do I need to change)? If my linux ifconfig comes back as 10.1.1.2 but my nslookup of httpS://dinkdonk   comes back as 10.1.10.20 which am I using as the ip for forwarding ip address  like when I do this on either linux or windows that ip should be the same right ? see below ./splunk add forward-server 10.10.10.10:9997 ./splunk set deploy-poll 10.10.10.10:8089 Also just making sure in this case my linux vm is my DS and search head and indexer right?     ... View more

So scenario is a vm that can ping another vm. 1st vm is linux rhel : I installed splunk enterprise and made it the deployment server  also yes I enabled receiving on 9997 2nd vm is a win 10 64 bit: Installed universal forwarder and did the customize option and put in IP of linux box for receiver and for deployment server. when I got to add data I get this error:  There are currently no forwarders configured as deployment clients to this instance. Learn More  I tried making the deployment server also be the deployment client but according to my reading you can't do that is this right? do I need a third box and make it either my deployment server or deployment client?   ... View more

 so it says Could not load lookup=LOOKUP-itsi_kpi_attributes   looking around find there are pointers i think. but if i click on lookup table files and filter for  itsi_kpi_attributes  i get ---> wait last one  If this says none what's worse this says none or no csv even though I see some pointer to a field that doesn't exist.   if I am right where is this file? if not # is what I am asking making sense #2 is there something else you'd like to see if so tell me where it is thanks.   ... View more