Deployment Architecture

Search Head Cluster Node fall in a restarting loop

nayuki
New Member

I deploy a Splunk Index Cluster, like following

  • 10.6.113.25 (peer node)
  • 10.6.113.26 (master node)
  • 10.6.113.27 (peer node)
  • 10.6.113.28 (peer node)

And I want to deploy Search Head Cluster in same cluster.

  • 10.6.113.25 (search head)
  • 10.6.113.27 (search head)
  • 10.6.113.28 (search head)
  • 10.6.113.32 (deployer)

I follow the doc: Deploy a search head cluster

Run splunk init shcluster-config in 25,27,28 and restart. But they fall in a restarting loop.

system/local/server.confin node 25

[clustering]
master_uri = https://10.6.113.26:8089
mode = slave
pass4SymmKey = $7$8BS4L6+X6dBUlQusZWdHNLNRkc7QurRQQnV3E9zG5YpWC5kAUj8=

[replication_port://34567]

[shclustering]
conf_deploy_fetch_url = https://10.6.112.32:8089
disabled = 0
mgmt_uri = https://10.6.113.25:8089
pass4SymmKey = $7$JN1I+/uq0kBl7+/fZZWOVKNO7LopWArjBLS7q4e1KO+sHlRb3pbNu28DsVoytuk=
replication_factor = 2
shcluster_label = shcluster1

And when restart, splunkd.log has 03-26-2019 14:05:41.395 +0800 INFO loader - Downloaded new baseline configuration; restarting ...

I'm not sure a node can be both Search Head Cluster node and Indexer Cluster node.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

They can't be a SHC member and IDX cluster member.

0 Karma

nayuki
New Member

I see [replication_port://<port>] in server.conf, and find that both index cluster and search head cluster use same config port. I think it may confilct.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...