Getting Data In

Search head cluster & Indexer cluster error :Unknown error for peer.Search Results might be incomplete & Slave is unable to handle request at this time

premforsplunk
Explorer

Hi folks,
I'm trying to troubleshoot couple of production issues, one related to SHC and other related Indexer clustering.
Would be helpful to get any solution to solve them,

Background: A Splunk standalone system has less data but extremely high number of concurrent / real-time searches. The searches themselves are fast-performing.
It was migrated first to (A) 1 Indexer + 3 SH's Cluster setup. It was then attempted to subsequently migrate to (B) 2 Indexers Cluster + 3 SH's Cluster setup.

Issue #1:
- SH dashboards showing error: “Unknown error for peer xx.xx.xx.xxx . Search Results might be incomplete. If this occurs frequently, please check on the peer.”
- This seems to correspond to Indexer errors: “WARN HttpListener - Socket error from xx.xx.xx.xxx.”

Issue #2: Unable to migrate to Indexer cluster setup (B), since error is shown: “ Slave is unable to handle request at this time. This means either slave unable to communicate w/ master OR master does not have peers added to the cluster. Check master dashboard and/or master_uri/secret settings.”

Could anyone help to resolve ? Thanks much in advance.

0 Karma

francisco_mota
Loves-to-Learn Lots

Is there any network latency?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...