×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
dannyard
New Member
Member since: ‎11-13-2017
‎10-10-2024
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎11-13-2017
Activity Feed
View All

Re: Why is there a failure error when integrating ...

by in Deployment Architecture
‎03-08-2018 11:01 AM
‎03-08-2018 11:01 AM
Sorry, yes - I accidentally left that of my post but I am adding the password after secret As an update, I went into server.conf on each SH cluster member and changed mode=disabled to mode=searchhead. I imagine that is what the command is supposed to do but it didn't work After doing so I was able to get the SH cluster integrated with the indexer cluster. I went back to run that command and this time it was successful, or so it said. Of course all was working so not sure if it actually did anything, but at least the command execution didn't error out. Wonder if others have had issues with this command ... View more

Re: Why is there a failure error when integrating ...

by in Deployment Architecture
‎03-07-2018 09:32 AM
‎03-07-2018 09:32 AM
I found a post online from someone that submitted their server.conf. I noticed on our searchheads, each server.conf file had mode=disabled whereas the poster had mode=searchhead. I changed that on each of my searchheads and now I am able to query the index cluster, but I'm not getting the same amount of data the stand alone search head sees (It's looking at the same indexer cluster) ... View more

Why is there a failure error when integrating splu...

by in Deployment Architecture
‎03-07-2018 07:34 AM
‎03-07-2018 07:34 AM
We have 3 node indexer Cluster and have setup a 3 node Search Head(SH) cluster. We are trying to integrate the SH cluster with the index cluster. I'm running the following command: ./splunk edit cluster-config -mode searchhead -master_uri https://master:8089 -secret I run this on each SH cluster member and they all give the following response: Could not contact master. Check that the master is up, the master_uri=https://master:8089 and secret are specified correctly I've confirmed that everything is correct. I tested with curl and telnet to make sure the master could be reached on 8089 from each SH. The search head cluster is up and running as is the indexer cluster. I've attempted to change master to fqdn and IP address. Does anyone have any other suggestions? This seems like such an easy fix but it's been driving me crazy for 2 days. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎10-10-2024 03:09 PM