Splunk Search

Search peers / Replication status / Initial

kevinsikora
Explorer

I'm trying to setup a distributed search. I have successfully added my search peers to the search head already.

The issue I have is when I use the web interface of Splunk, for the search head, I see that a few of my search peers have the (Replication status) of (Initial). I am not sure how to get these to have the status of (Successful).

To view my search peers, I went to the following location:

Manager > Distributed search > Search peers

Does anyone have an idea of I still need to do in order to get these statuses to change?

gwen
Loves-to-Learn Lots

An instance name was incorrect.

Check in slm web -> setting -> console monitoring -> setting-> general setup

or

#opt/splunk/etc/system/local/input.conf in your search head.

I've changed the name of an instance and I'm doing

#splunk resync shcluster-replicated-config on the search head to which you have changed the name.

The error has disappeared for the moment. I'm currently monitoring the situation to see if the problem returns.

0 Karma

gwen
Loves-to-Learn Lots

I have the same problem and I'm stuck a bit, can someone help me find some ideas?

in the splunk search head web interface => settings => advance settings => distributed search => search peer => the "replication status" column is in "initial" state when it should be successful

when I perform a health check I get a message that tells me "opportunity to move from search head pooling to search head cluster"

disabling then re-enabling the indexer cluster could be a solution. I'm a little afraid of breaking everything by doing this.

0 Karma

kevinsikora
Explorer

Restarting Splunk solved this issue. I'm not sure why my other search peers had a successful status right away.

araitz
Splunk Employee
Splunk Employee

Need more information. Is there any information in splunkd.log about peer replication? Are there any errors indication a connection or authentication problem?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...