After deploying a search head cluster, I have a problem with searching anything. SHcluster status is up, but when I logged on each shcluster members, I've noticed in "Distributed environment" -> "Distributed search" -> "Search peers" that authentication to my two indexers failed. In server.conf on each member, pass4SymmKey in [general] stanza and [shclustering] stanza is the same. Has anyone had a similar problem?
Hello,
I had found solution these problem, pass4SymmKey should be the same for shcluter and indexer cluster
and I had to change shcluster's member server name in inputs.conf and server.conf, because were duplicated for some hosts in the cluster. After that the problem disaperaed
What error did you get after running the splunk edit cluster-config command on the search heads as descibed here: http://docs.splunk.com/Documentation/Splunk/6.3.3/DistSearch/SHCandindexercluster
Yes, indexers are also in a cluster
Are your indexers also in a cluster?
Have you followed the procedure listed here?
http://docs.splunk.com/Documentation/Splunk/6.2.7/DistSearch/Connectclustersearchheadstosearchpeers