Dear Guys,   This is about applying shcluster-bundle, fail with Error       splunk apply shcluster-bundle -target https://xxx.xxx.xxx.62:8089 -auth admin:”<password>”   it makes the below messages. Error while deploying apps to first member, aborting apps deployment to all members: Error while fetching apps baseline on target=https://xxx.xxx.xxx.62:8089 Non-200/201 status_code=401; {"messages":[{"type":"WARN","text":"call not properly authenticated"}]} So then I've checked and tried the below contents. The pass4SymmKey under shclustering stanza is the same hash on all 3 members and the deployer The pass4SymmKey under shclustering stanza is the same hash on all 3 members (without deployer) Bundle size is no problem All server uses same admin/password for web Each search head has uniq guid(/opt/splunk/etc/instance.cfg)   In addition, when it commanded: SearchHead Member #1 - $SPLUNK_HOME/var/log/splunk/splunkd.log **-**-**** **:**:37.454 +0900 ERROR DigestProcessor - Failed signature match **-**-**** **:**:37.454 +0900 ERROR LMHttpUtil - Failed to verify HMAC signature, uri: /services/shcluster/member/members?output_mode=json&count=-1 **-**-**** **:**:37.457 +0900 ERROR DigestProcessor - Failed signature match **-**-**** **:**:37.457 +0900 ERROR LMHttpUtil - Failed to verify HMAC signature, uri: /services/apps/local?output_mode=json&count=-1&show_hidden=1   SearchHead Deployer - $SPLUNK_HOME/var/log/splunk/splunkd.log **-**-**** **:**:32.809 +0900 INFO TcpOutputProc - After randomization, current is first in the list. Swapping with last item **-**-**** **:**:32.812 +0900 INFO TcpOutputProc - Connected to idx= xxx.xxx.xxx.64:9997, pset=0, reuse=0. **-**-**** **:**:37.456 +0900 WARN AppsDeployHandler - Error while fetching members from uri=https://xxx.xxx.xxx.62:8089: Non-200 status_code=401: Unauthorized **-**-**** **:**:37.459 +0900 WARN AppsDeployHandler - Error while deploying apps to first member, aborting apps deployment to all members: Error while fetching apps baseline on target=https://xxx.xxx.xxx.62:8089 Non-200/201 status_code=401; {"messages":[{"type":"WARN","text":"call not properly authenticated"}]}   Please let me know your tips ... View more

Hello, Cloud you give me some tips. Search Query S1 index=S1 | bla bla bla | stats value(dstIP) value(dstPort) value(srcIP) value(srcUser) by URL In S1's results, I want to add "sum(Byte)", Byte is in S2. Also S2's log has dstIP, dstPort and Byte. From comparing S1_dstIP with S2_dstIP, I want to add "sum(Byte)" on the search result. ... View more

Hello Guys, I've checked version compatibility But, I want to make sure from this. Our Heavy forwards is 7.1.2, Indexer and the others will be 7.3.x So is it compatible perfectly? ... View more