Splunk Search

Why can only the Search Head Captain search the Indexer Cluster?

iacobeaj
New Member

I have a search head cluster that is trying to search across an indexer cluster, but for some reason, only the Currently elected captain can search the indexers and get data back. All of the other members come back with the errors

"Gave up waiting for the captain to establish a common bundle version across all search peers; using most recent bundles on all peers instead." 

and

"Search filters specified using splunk_server/splunk_server_group do not match any search peer." 

When I do the search on the captain, I get results as I would expect.

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

inconsistent search peers across search head cluster members will cause search dispatch issues and the error message you see.

Check distsearch.conf on each of the Search Head Cluster Member something like

find */etc/{apps,system} -name distsearch.conf | grep local | xargs grep --color 'servers ='

Or else you can run btool for distsearch on each search head using command

$SPLUNK_HOME/bin/splunk cmd btool distsearch list --debug

and look for Server

number of Splunk Server should match on each Search Head Cluster Member.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...