Splunk Dev

questions about splunk apply shcluster-bundle running a long time and eventually failed

lim2
Communicator

questions about splunk apply shcluster-bundle running a long time and eventually failed because of "Connection reset by" from Splunk deployer server.
Splunk 7.1.5. SH Cluster of 4 servers on AWS Linux
As a result I'm getting:
/opt/splunk/bin/splunk show shcluster-status
Splunk username: admin
Password:

Encountered some errors while trying to obtain shcluster status.
This node is not the captain of the search head cluster, and we could not determine the current captain. The cluster is either in the process of electing a new captain, or this member hasn't joined the pool

Found that splunk was not running on the SH Cluster captain and that 1 SH server was not responding to ssh
1) How to get the " splunk apply shcluster-bundle" command to provide more verbose feedback?
2) Like what SH server the bundle is being pushed to and what the % completion?
3) Any errors like SH server not reachable.
Luckily I was doing this in my test env, but how could the command be more smoothly ran?
Thanks

Tags (1)
0 Karma

skalliger
Motivator

You might want to use the Monitoring Console for analysing the details further. The MC comes with some nice dashbaords giving you an insight into your deployment, including deployment bundle sizes and how long it took to deploy.

A connection reset could have several root causes and without further logs, this is hard to isolate.

Skalli

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...