Deployment Architecture

The searchhead is unable to update the peer information. Error = 'Master has multisite enabled but it is missing the 'multisite' attribute' for master=https://127.0.0.1:8990

jackiewkc
Path Finder

Does anyone know how this can be fixed? Thanks.

Tags (2)
1 Solution

svasan_splunk
Splunk Employee
Splunk Employee

jackiewkc,

Did the master start up okay? I suspect there is probably an error in the log saying clustering was not initialized on the master. The master needs a 'site=...' attribute too which is missing in your config. The site attribute should be under [general] stanza as dxu pointed out. Also site_replication_factor and site_search_factor are need on the master not the searchheads.

See: http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Multisiteconffile

The cli commands for setting up indexer clustering will put the entries under the right stanza. See: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/MultisiteCLI

View solution in original post

mgonter_splunk
Splunk Employee
Splunk Employee

You need to have multisite = true on the search head. It's confusing based on the server.conf.spec because it says it used to inilizae the master. However, this needs to be on your search heads and Cluster Master. Not your indexers. The Site= Site1 needs to be on the indexers. But the search head config needs the following:

[general]
site = site1

[clustering]
multisite = true
master_uri = https:/A.IP.Address:8089
mode = searchhead

http://docs.splunk.com/Documentation/Splunk/6.2.3/Indexer/Multisiteconffile

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Pls ensure that mutlisite = true is entered in [general] stanza in the Cluster Master and restart the Cluster Master.

0 Karma

svasan_splunk
Splunk Employee
Splunk Employee

jackiewkc,

Did the master start up okay? I suspect there is probably an error in the log saying clustering was not initialized on the master. The master needs a 'site=...' attribute too which is missing in your config. The site attribute should be under [general] stanza as dxu pointed out. Also site_replication_factor and site_search_factor are need on the master not the searchheads.

See: http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Multisiteconffile

The cli commands for setting up indexer clustering will put the entries under the right stanza. See: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/MultisiteCLI

jackiewkc
Path Finder

Thanks. Adding site=1 to the master and then restarting it fixed the issue.

0 Karma

jkat54
SplunkTrust
SplunkTrust

you meant site=site1 i assume. site=1 is invalid.

0 Karma

jackiewkc
Path Finder

Thanks a lot for the quick reply. Unfortunately I am unable to figure out why this is happening.

In server.conf on the master, I have this:

[clustering]
mode = master
multisite = true
available_sites = site1, site2

On the two search heads I have got, I have this in server.conf:

[clustering]
master_uri = https://master01:8990/
site_replication_factor = origin:2, total:3
site_search_factor = origin:1, total:2
multisite = true
site = site1

Any idea?

0 Karma

dxu_splunk
Splunk Employee
Splunk Employee

the site= line should go under the [general] stanza, try moving it there

0 Karma

jackiewkc
Path Finder

Hi, seems like the the issue is with missing site= for the master. This is fixed now. Thanks.

0 Karma

kml_uvce
Builder

check multisite and site parameters are properly used in server.conf
http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Serverconf

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...