Why does my search peer come up as an error on my search head?

[timmy13]

I've added a search head as a search peer and it's come up as "sick" with the following error. Can't seem to find any reference to it here.

Error [00800000] Failed 11 out of 11 times. Servername used by peer is already in use by the search head.

It suggests a dns issue, but none exists that I can see.

[mahsaalaeifar]

resolved: I checked the server.conf , server name was wrong, after editing the name and restarting all are good

[esix_splunk · Accepted solution]

From your search head, when you do a host or dig against the peer hostname, what does it return?

Check your server.conf file on the search head and make sure all the host names are correct.

If youre on linux, you could consider using the local /etc/hosts file as a work around.. This wouldnt be recommended for a sustained production environment..

[timmy13]

That was it. Had duplicate IP's in the server.conf file. Not sure how that happened but good call.

Interestingly the same search head is not being seen by the Distributed Management console and this didn't resolve that problem.

[esix_splunk]

Glad that fixed it.

For your DMC host, you'll need to add the other Splunk nodes as search peers in order for the DMC to work properly. If you have previously added them, I would check the server.conf on the DMC host and make sure the resolution is correct there also.