Error "Duplicate Servername"

[rajeshm]

Hi

We are getting the following error message while accessing any application.

Unable to distribute to peer named at uri https://<Ip Address:8089 because peer has status = "Duplicate Servername".

Regards

Rajesh

[Prakhar_shukla]

did u try disable distribution search ?

[khyoung7410]

enable and disable done.
But there is no difference.

[dglinder]

A non-Splunk specific cause might be a fat-fingered entry in the systems hosts file, or in the DNS entry for the server name listed in the "at uri" portion of the error message.

[khyoung7410]

I used vmware.
I have installed one server 6.3.10 and 6.4.4.
The configuration is one search header and three indexers.
I finished the configuration and restarted the search header.
Then I searched the search-header below.
- search query : index=_internal source=*splunkd.log log_level=ERROR Distribute
The results below only appear in 6.4.4.

6.3.10 search header distribute search detail

[Prakhar_shukla]

Ok, let me get it clearly.! You have total 3 indexer and 2 search heads. Both are in different version. Do you have any counter master?

[Prakhar_shukla]

Correction. Cluster master

[khyoung7410]

I have 1 search header and 3 indexer 6.3.10.
Also 1 search header and 3 indexer 6.4.4.
I don't have a cluster master.

[Prakhar_shukla]

So its like 1 search head + 3 indexer at 6.3 and a search head + 3 indexer at 6.4.
Total 8 server, 2 different groups. Right?

Please pasted splunk.Log here from server.

[Prakhar_shukla]

From your previous post figures where you put search head 6.4 that was showing error. I observed indexer are same in both search head. 192.168.88.130 and 192.168.88.131.

[Prakhar_shukla]

What's current config is like. Please paste all detail like SH names and which connectior is linked with which search head

[khyoung7410]

When I paste the contents of Splunkd.log, the following message is displayed.
"Your comment was submitted, and will be reviewed by a moderator before being visible to all users."

[Prakhar_shukla]

What's current config is like. Please paste all detail like SH names and which connectior is linked with which search head

[khyoung7410]

05-01-2017 23:48:18.159 +0900 INFO ClusteringMgr - clustering disabled
05-01-2017 23:48:18.159 +0900 INFO SHClusterMgr - initing shpooling with: ht=60 rf=3 ct=60 st=60 rt=60 rct=5 rst=5 rrt=10 rmst=600 rmrt=600 pe=1 im=0 is=0 mor=5 pb=5 rep_port= pptr=10
05-01-2017 23:48:18.159 +0900 INFO SHClusterMgr - shpooling disabled
05-01-2017 23:48:18.159 +0900 INFO PipelineComponent - registering timer callback name=DistributedRestCallerCallback callback=0x7f2709a51590 arg=0x7f2706365080 size=4 aborts=0x0 gen=4 accCbMsecs=0ms
05-01-2017 23:48:18.264 +0900 ERROR DistributedPeer - Peer:https://192.168.88.130:8090 Duplicate Servername
05-01-2017 23:48:18.264 +0900 ERROR DistributedPeer - Peer:https://192.168.88.131:8090 Duplicate Servername
05-01-2017 23:48:18.264 +0900 INFO ServerRoles - Declared role=search_head.
05-01-2017 23:48:18.264 +0900 INFO IndexerInit - running splunkd specific init
05-01-2017 23:48:18.271 +0900 INFO IndexerService - indexes.conf - indexThreads param autotuned to=2
05-01-2017 23:48:18.271 +0900 INFO IndexerService - indexes.conf - memPoolMB param autotuned to=64MB
05-01-2017 23:48:18.271 +0900 INFO MPool - MPool initialized: bytes=67108864

[khyoung7410]

I changed the general stanzas of the three indexers.

Indexer #1 server.conf
[general]
serverName = server_22
pass4SymmKey = $1$tvTHmsS5kq97

Indexer #2 server.conf
[general]
serverName = server_33
pass4SymmKey = $1$oQ/VgulsS5WG

Indexer #3 server.conf
[general]
serverName = server_44
pass4SymmKey = $1$ZjxhnZAKdFJe

My Search Header splunkd.log

05-02-2017 10:05:24.103 +0900 ERROR DistributedPeer - Peer:https://192.168.88.130:8090 Duplicate Servername
05-02-2017 10:05:24.085 +0900 ERROR DistributedPeer - Peer:https://192.168.88.131:8090 Duplicate Servername
05-02-2017 10:05:24.085 +0900 ERROR DistributedPeer - Peer:https://192.168.88.130:8090 Duplicate Servername

Indexers do not show error logs.

[khyoung7410]

05-01-2017 23:48:18.264 +0900 ERROR DistributedPeer - Peer:https://192.168.88.130:8090 Duplicate Servername
05-01-2017 23:48:18.264 +0900 ERROR DistributedPeer - Peer:https://192.168.88.131:8090 Duplicate Servername

[Prakhar_shukla]

What's current config is like. Please paste all detail like SH names and which indexer is linked with which search head

[khyoung7410]

The log is not strangely attached.

[khyoung7410]

I tried several times, but I can not paste all the logs from splunkd.log.

[khyoung7410]

I compared version 6.3.10 and version 6.4.4.
I installed Splunk and set up distributed search only.
There was no such error in 6.3.10.
"ERROR DistributedPeer - Peer: https: //192.168.88.131: 8090 Duplicate Servername"
However, since using version 6.4.4, this error message has occurred.
Why do I get this message?

[Prakhar_shukla]

Hi khyoung7410,
what is the current set up of your splunk? where you seeing this error and is it for an indexer?
check the setting> distributed search> search peer detail and server.conf