ERROR: Unable to add search peers: connection reset by peer

Applicability

Splunk Enterprise

Description

Trying to add new indexers as well as new search heads in the environment, the indexers are part of the cluster but the search heads are not configured as a cluster.

Other indexers are already set as peers for the search heads in questions but the search heads have other indexers as search peers.

 

Investigation

• Check the SSL setting is right and no issues are related to connectivity.
• Errors in splunkd.log show: SSL connection could not be established, connection reset by peer for indexer's IP address.
• Manual configuration using configuration files as well as GUI setup fails the same.
• Confirm https is used for the URI of the indexers since SSL is in use.
• Confirm the indexers in question are set up in cluster mode.
• Search heads are not clustered

Resolution

As indexers are clustered the search head should have the search head mode enabled in server.conf otherwise the indexer cluster won't recognize the instance properly and refuse the peer request.

Keep in mind the search head needs a clustering stanza although the search heads are not clustered.

1. Configure the server.conf file as follows

[clustering]
master_uri = https://x.x.x.x:xxxx (https://x.x.x.xxxxx)
mode = searchhead
pass4SymmKey= yourPass4SymmKey

master_uri = the cluster master URI for the **Indexers cluster**, search heads are distributed not clustered for this case.
mode =  this is required to set the server in search head mode for cluster communication
pass4SymmKey = key for the cluster, the users should add his/her own key for such attribute

Related Links

Splunk Documentation
Add search peers to the search head:
https://docs.splunk.com/Documentation/Splunk/7.3.0/DistSearch/Configuredistributedsearch

Revision History

Revision	Publish Date	Comments
1.0	28-Sep-2026	Initial Release