×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
MichelMichel
Explorer
Member since: 3 weeks ago
2 weeks ago
Community Statistics
Posts 4
Solutions 1
Karma Given 0
Karma Received 0
Member Since ‎06-19-2026
View All

Re: Splunk API for SH bootstrap

by in Splunk Enterprise
2 weeks ago
2 weeks ago
For anyone having the same issue, the fix was as simple as forcing the REST API call to be a POST (such as using -X POST on curl or sending empty data). It appears the API has changed to make this endpoint accept POST only but the data (servers_list) is still passed as an encoded argument to the endpoint for some reason, perhaps it will change in some future update. ... View more

Re: Splunk API for SH bootstrap

by in Splunk Enterprise
3 weeks ago
3 weeks ago
Hi @livehybrid, I don't see anything related in the logs, splunkd.log doesn't seem to log anything, the only thing I saw is the successfull authentication in audit.log; I also unfortunately cannot share the full logs here. When trying this endpoint I get the standard Splunk error body response format (type="ERROR") with the following message: "The specified custom action of this endpoint requires POST". The odd thing is that it does not seem to support POST request because the argument 'servers_list' is refused when passed as data (with the error "Argument '{'servers_list': '<value>'}' is not supported by this handler."). In version 9.3 the request worked normally when using GET. The '$SPLUNK_HOME/etc/system/static/splunkrc_cmds.xml' file does mention it and it has not changed between version 9.3 and 10.2 which is even more odd; the same command using CLI has also not changed so I guess I am missing something. If all else fails I can always set up some proxy to intercept the actual request using CLI but I'd rather not. I also understand that it was meant by Splunk as an internal handler and not a production endpoint, but this is a rather important feature which is very much needed in my particular use case. Thank you for your help ! ... View more

Splunk API for SH bootstrap

by in Splunk Enterprise
3 weeks ago
3 weeks ago
Hello everyone, The splunk API documentation does not mention it, but the endpoint: "/services/shcluster/member/consensus/default/bootstrap?servers_list=<some_servers>" could be used in Splunk Enterprise version 9.3 to perform a SHCluster bootstrap manually from API. However, this does not work in version 10.2 anymore, and there is no documentation mentionning it to my knowledge. Does anyone know how can this be done from API in 10.2 ? Thanks ... View more

KVStore stuck on starting on SH cluster with more ...

by in Splunk Enterprise
3 weeks ago
3 weeks ago
Hello everyone, Starting from version 10.2.0 and apparently all above, I have an issue concerning the KVStore. As indicated in the title, on SH members, if the replication factor is set to more than 1 (I have only tried 2 and 3) the KVStore never starts, its status is stuck on 'starting' (using show kvstore-status) forever. I have seen the issue SPL-299914 in the Splunk release notes(fixed in 10.2.3 AND 10.2.4) which seem to correlate with my problem but the fix does not seem to actually resolve my problem. (I have also tried version 10.4.0 without success) For the context, I have 3 SH members running on linux that can be configured to work either independently or in a common SHCluster, the configuration was done by adding the following parameters in server.conf for standalone SH members and removing them in a cluster: "[shclustering] captain_uri=<some_uri> election=0 mode=captain" And tweeking the replication factor to the number of members ([1-3]). This worked fine on version 9.3.4 and above but not anymore. In version 10.2.0 specifically (from my test but to confirm), the mongod.log indicate a segfault when trying to start which causes it to start in a loop without success, however in 10.2.4 and 10.4.0 I don't have any relevant log in mongod.log and no more segfault or any crash for that matter. As for splunkd.log I only saw a vague log mentioning a KVStore error without additional informations but I might have missed something. Due to confidentiality issues I unfortunately cannot share them here, but if someone has seen similar behaviors, perhaps I could be pointed in the right direction ? ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
2 weeks ago