All Apps and Add-ons

splunk apply shcluster-bundle command fail with Error

vin02
Path Finder

When i am trying to run the below cluster bundle command it is throwing error message

/opt/splunk/bin/splunk apply shcluster-bundle -target https://splunk-search:8089 -auth : --answer-yes -preserve-lookups true

ERROR : Error while deploying apps to target=https://splunk-search:8089: No captain found amongst members

And when i am checking for the cluster status then also getting error

splunk show shcluster-status -auth :

ERROR: Search Head Clustering is not enabled on this node. REST endpoint is not available

Could please help me on this.

Tags (1)
0 Karma
1 Solution

hunters_splunk
Splunk Employee
Splunk Employee

Hi Vin02,

Obviously, your captain is down or has not been initialized in your shc. You must designate a cluster member - any instance - as the captain, which is responsible for orchestrating replication activities across your cluster. For instructions on bringing up the cluster captain, please following the steps here in the documentation:
http://docs.splunk.com/Documentation/Splunk/6.6.0/DistSearch/SHCdeploymentoverview#5._Bring_up_the_c...

Hope this helps.
Thanks!
Hunter

View solution in original post

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi Vin02,

Obviously, your captain is down or has not been initialized in your shc. You must designate a cluster member - any instance - as the captain, which is responsible for orchestrating replication activities across your cluster. For instructions on bringing up the cluster captain, please following the steps here in the documentation:
http://docs.splunk.com/Documentation/Splunk/6.6.0/DistSearch/SHCdeploymentoverview#5._Bring_up_the_c...

Hope this helps.
Thanks!
Hunter

0 Karma

koshyk
Super Champion

before you apply bundle, can you please check
show shcluster-status
Run this from one of the SH member. If captain is NOT shown, you need to first setting up SHC correctly using init. Apply bundle only after you are 100% sure the SHC is setup correctly

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...