Deployment Architecture

Search head on Windows can't connect to index cluster master after update from 6.2.1 to 6.3

glentes
Path Finder

Hello community,

I have just updated a standalone search head running on Windows 7 64 Bit from 6.2.1 to 6.3.
The search head is conencted to a 6.2.1 index cluster and I'm getting the following error message

The searchhead is unable to update the peer information. Error = 'failed method=POST path=/services/cluster/master/generation/BB1E749C-349F-45E9-ADB7-0A08CFD13604/?output_mode=json master=indexclustermaster:8089 rv=0 actual_response_code=400 expected_response_code=200 status_line=Bad Request error=No error' for master=https://indexclustermaster:8089.

I removed the following configuration from the local server.conf

[clustering]
master_uri = https://indexclustermaster:8089
mode = searchhead

restarted the search head and used http://localhost:8000 -> settings -> Indexer Clustering -> Enable Indexer Clustering -> choose Search Head Node
to enable the search head again.

After a restart I got the same error again and can'T access any events stored on the index cluster.

From the splund.log:
09-23-2015 13:26:00.196 +0200 WARN CMMasterProxy - Master is down! Make sure pass4SymmKey is matching if master is running.
09-23-2015 13:26:00.196 +0200 ERROR DistributedPeerManager - Unable to connect to the master or received no peer list from the cluster master.'failed method=POST path=/services/cluster/master/generation/BB1E749C-349F-45E9-ADB7-0A08CFD13604/?output_mode=json master=indexclustermaster:8089 rv=0 actual_response_code=400 expected_response_code=200 status_line=Bad Request error=No error' for master=https://indexclustermaster:8089

Looks for me like the pass4SymmKey is not matching anymore after teh update.

Is this problem known? Any suggestion from your side.

Thanks a lot in advance.

Tags (1)
0 Karma
1 Solution

nvanderwalt_spl
Splunk Employee
Splunk Employee

Have you upgraded the cluster master to 6.3 as well? The peer nodes and search heads must run the same or a lower version than the master node.

View solution in original post

glentes
Path Finder

Thank you fast answer and the information.
I just found the compatibility information on page
http://docs.splunk.com/Documentation/Splunk/6.3.0/Indexer/Systemrequirements#Splunk_Enterprise_versi...

0 Karma

nvanderwalt_spl
Splunk Employee
Splunk Employee

Have you upgraded the cluster master to 6.3 as well? The peer nodes and search heads must run the same or a lower version than the master node.

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...