I am getting the below error on my search head for all the queries.
"Unable to distribute to peer named X.X.X.X:PPPP at uri=X.X.X.X:PPPP using the uri-scheme=https because peer has status="Down". Please verify uri-scheme, connectivity to the search peer, that the search peer is up, and an adequate level of system resources are available. See the Troubleshooting Manual for more information."
Where X.X.X.X is indexer IP address and PPPP is port.
When I tried to look what's happening in the internal logs I only see the below warning message on all the events
Query used :-index="_internal" source=/cs/splunk/search/var/log/splunk/splunkd.log X.X.X.X
Warning log :- 02-24-2018 16:35:15.331 +0100 WARN DistributedPeerManager - Unable to distribute to peer named X.X.X.X:PPPP at uri=X.X.X.X:PPPP using the uri-scheme=https because peer has status="Down"
Please verify uri-scheme, connectivity to the search peer, that the search peer is up, and an adequate level of system resources are available. See the Troubleshooting Manual for more information.
I have tried the below to identify the issue
1. removing the cluster and re-adding it doesn’t resolve this problem
2. Rebooting the indexer doesn't help
3. I can see some buckets showing up on indexer when searching it, however, most of them are unavailable.
Could anyone suggest what exactly could be the issue?
**Note :-** search head version :- 6.5.3 and indexer version for host X.X.X.X is : 6.6.5
I know that upgrading the search head to the version 6.6.5 would resolve this but I'm trying to find the reason why it fails when the search head version is lesser than the indexer version
↧