I manage a couple of small splunk clusters and for the 1st time I need to build one form scratch. I am testing in our sandbox env but when I bring the cluster up I end up with index issues that cant seem to be resolved.
cannot fix up search factor as bucket is not serviceable
Cannot fix search count as the bucket hasn't rolled yet.
The above messages show up for every bucket in the _audit and _internal indexes. The build is a fairly simple one 2 indexer peers 1 master 1 dedicated search head
1- It's RHEL based
2- Install the rpm, 7.0.3 is the version I am playing with
3 - Set the firewall rules to allow the traffic
4 - /opt/splunk/bin/splunk enable boot-start -user root --accept-license
5 - /opt/splunk/bin/splunk start --accept-license
For the master I run - /opt/splunk/bin/splunk edit cluster-config -mode master -replication_factor 2 -search_factor 2 -secret xxx -cluster_label test
For the indexer peers - /opt/splunk/bin/splunk edit cluster-config -mode slave -master_uri https://xx.xxx.xx.xx:8089 -replication_port 9887 -secret xxx
For the Search head - /opt/splunk/bin/splunk edit cluster-config -mode searchhead -master_uri https://xx.x.xxx.xx:8089 -secret xxx
Restart the splunk on the master then config the other nodes and restart splunk.
Not sure what I am missing or doing wrong
↧