Deployment Architecture

Distributed Search with Search head Pooling, Deployment Monitor

jfaldmo
Explorer

There are two issues I am having with a new setup. We have 2 search heads and 3 indexers.
The first issue is with a shared bundle for one of the search heads.

I only get this error for one of the search heads. --
"StreamedSearch - Failed to create a bundles setup with server name 'l02'. Using peer's local bundles to execute the search, results might not be correct"

The second issue is with the Deployment Monitor. The instructions say the Deployment monitor just needs to be setup on one of the search heads. I'm not sure why this says it would be disabled on the indexer. --
Streamed search execute failed because: Application is disabled: SplunkDeploymentMonitor

This might be related error to the second issue --

 ERROR LMTracker - failed to send rows, reason='problem with message to master=https://[searchhead]:8089, reason='Response from https://[searchhead]:8089 was 403: body='

path=/masterlm/usage: invalid signature on request from ip=

'''

Any help or suggestions of these two issues are appreciated.

Tags (1)
0 Karma
1 Solution

jfaldmo
Explorer

After setting up the license pool again the error "LMTracker" error went away. I'm still trying to figure out some errors that seem to be related to the deployment monitor and search heads. I'll try and close this and ask a new question with better details.

View solution in original post

0 Karma

jfaldmo
Explorer

After setting up the license pool again the error "LMTracker" error went away. I'm still trying to figure out some errors that seem to be related to the deployment monitor and search heads. I'll try and close this and ask a new question with better details.

0 Karma

paul_1994
Path Finder

Did you ever get an awnser to your deployment issue? I just ran into the same error after using a shared bundles

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26

At .conf26 in Denver, I spent much of my time in conversation with Splunk customers about Splunk AI Assistant. ...

Make Your Machine Data AI-Ready in Splunk

Every team is getting ready for AI agents.   Thursday, November 12, 2026  |  11AM  PST / 2PM EST   ...

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...