Hi guys,
I'm having a problem with my environment, we have 15 machines, 1 Master, 1 Deploy, 1 Universal Forwarder, 6 Search Head, 5 Indexers. The message below begin to appear in my search heads.
The search head cluster captain (https://server0011:8089) is disconnected; skipping configuration replication
We have replication factor of 1 to 3.
What can be ?
This usually happens to me when the cluster master goes down for whatever reason.
Try running 'splunk status' on the captains command line. Then perhaps you'll fine a 'splunk start' is in order.
I would suggest looking at your conf.log for "data.worklog{}.status”=STOP_ON_MISSING_LOCAL_BASELINE
This would tell you if there are potential out of sync nodes from the clusters' captain. I see that these messages automatically disappear. Would that mean the node has dropped its captaincy and after re-synced to the new captains bundle?
We are experiencing this issue. Any solution?
we have the same problem did you find a solution?