Splunk Search

Captain Skipping Configuration Replication

rafamss
Contributor

Hi guys,

I'm having a problem with my environment, we have 15 machines, 1 Master, 1 Deploy, 1 Universal Forwarder, 6 Search Head, 5 Indexers. The message below begin to appear in my search heads.

The search head cluster captain (https://server0011:8089) is disconnected; skipping configuration replication

We have replication factor of 1 to 3.

What can be ?

jkat54
SplunkTrust
SplunkTrust

This usually happens to me when the cluster master goes down for whatever reason.

Try running 'splunk status' on the captains command line. Then perhaps you'll fine a 'splunk start' is in order.

0 Karma

ben_leung
Builder

I would suggest looking at your conf.log for "data.worklog{}.status”=STOP_ON_MISSING_LOCAL_BASELINE

This would tell you if there are potential out of sync nodes from the clusters' captain. I see that these messages automatically disappear. Would that mean the node has dropped its captaincy and after re-synced to the new captains bundle?

0 Karma

jeremykampwerth
New Member

We are experiencing this issue. Any solution?

0 Karma

aalanisr26
Path Finder

we have the same problem did you find a solution?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...