I've got a distributed search setup (standalone search head and an indexer) that has been working like a champ for awhile . Recently I started to see this message when I run a search:
Failed to create result provider for remote peer 'splunk.example.com' at uri 'https://splunk.example.com:8089' with the stream...
To my knowledge nothing has changed in my enviornment. What does this message mean and how can I prevent it?
A 'result provider' is basically a search connection, how stable is your connection to that box? Can you get to the Splunk instance running on splunk.example.com with a browser or CLI?