Hi Neovenkat, I think this is due to replication factor. Setting the replication in search head clustering is optional. I have the same environment as like yours. If you see below server.conf, i haven't set the rep factor. Please remove rep factor and do the splunk restart and try again. I hope it will work. server.conf: [shclustering] conf_deploy_fetch_url = https://XX.XX.XX.XX:8089 disabled = 0 mgmt_uri = https://XX.XX.XX.XX:8089 pass4SymmKey = ***** shcluster_label = shcluster1 id = **** ... View more

The daily scheduled searches are going to be affected because of this. Is there any workaround for this for daily scheduled searches. Whats happening is: The daily scheduled search reruns automatically for all the days from the beginning till DST start date and thus creating duplicate summary data. This is because splunk is not able to resolved the time modifier snapped to day. Any workarounds for this would be highly appreciated. Meanwhile a case has been raised with Splunk to look into this issue. ... View more

Even i have seen this behavior. You need not add the attributes sslKeysPassword and password to server.conf and inputs.conf respectively. Without you entering these attributes, splunk adds them. See my other post: https://answers.splunk.com/answers/643307/why-is-the-ssl-connection-between-forwarder-and-in.html In my case: a. in server.conf, i did not even have [sslConfig] stanza. Splunk adds that and underneath sslKeysPassword attribute also. b. In inputs.conf, i had [SSL] stanza but not password attribute. During restart splunk adds password attribute. ... View more