Deployment Architecture

What does "Failed to create result provider for remote peer " mean?

matt
Splunk Employee
Splunk Employee

I've got a distributed search setup (standalone search head and an indexer) that has been working like a champ for awhile . Recently I started to see this message when I run a search:

Failed to create result provider for remote peer 'splunk.example.com' at uri 'https://splunk.example.com:8089' with the stream...

To my knowledge nothing has changed in my enviornment. What does this message mean and how can I prevent it?

Mick
Splunk Employee
Splunk Employee

A 'result provider' is basically a search connection, how stable is your connection to that box? Can you get to the Splunk instance running on splunk.example.com with a browser or CLI?

Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...