Deployment Architecture

how to enable initialized flag in search head cluster

maede_yavari
Explorer

Hi,

we have deployed a search head cluster with two search head and one deployer.

when we run : /opt/splunk/bin/splunk apply shcluster-bundle -target  https://sh1.example.com:8089

we get the following message:

Error when issuing rolling restart on the master: Internal Server Error{"messages":[{"type":"ERROR","text":"Rolling restart cannot be initiated without service_ready_flag = 1, check status through \"splunk show shcluster-status\". Reason :Waiting for 3 peers to register. (Number registered so far: 2)"}]}

and when we run the following command:

splunk show shcluster-status

the initialized_flag equal 0.

 

Captain:
dynamic_captain : 1
elected_captain : Wed Nov 8 13:05:58 2023
id : 84F622C1-C493-4A7C-B12B-D7EDBBCCD3A8
initialized_flag : 0
kvstore_maintenance_status : disabled
label : sh2
mgmt_uri : https://sh2.example.com:8089
min_peers_joined_flag : 0
rolling_restart_flag : 0
service_ready_flag : 0

Members:
sh2
label : sh2
mgmt_uri : https://sh2.example.com:8089
mgmt_uri_alias : https://sh2.example.com:8089
status : Up


sh1-server
label : sh1-server
last_conf_replication : Pending
mgmt_uri : https://sh1.example.com:8089
mgmt_uri_alias : https://sh1.example.com:8089
status : Up

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @maede_yavari,

each Search Head Cluster requires at least three nodes not two and a Deployer as you can read at https://docs.splunk.com/Documentation/Splunk/9.1.1/DistSearch/SHCarchitecture

Ciao.

Giuseppe

FelixLeh
Contributor

 Check in the Monitoring Console -> Settings -> General Setup
If all Roles are assigned correctly.  Is distributed mode turned on?

0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...