Search Head Clustering Flashcards
What are the architecture benefits of Search Head Clustering?
Allows for horizontal scaling, High Availability.
What is the main role of the Deployer?
Deployer only manages configurations. THe Captain does the bulk of the work
Can the Deployer be a member of the Search Head Cluster
No
How many members must a search head cluster contan to meet which requirements?
At least three members
or the replication factor of instances if more than 3.
How do you initialize the cluster?
./splunk init shcluster-config -auth UN:PW -management_uri LOCALAddress:8089 -replication_port 9991 -replication_factor 5 conf_deploy_fetch_url deployer:8089 -secret 12345 -shcluster_label
Restart Splunk
In a search head cluster, what is replicated?
Cluster replicated runtime knowledge Objects
- Saved searches, Lookup tables, Dashboards
In a search head cluster, what is Deployed ?
Use the Deployer to push apps and other non-runtime configs to members.
Should the search heads index their own data?
No, forward to the indexer layer
What is the Role of a Captain?
The captain is a cluster member, performs normal search activities
When does captain election happen?
The current captain fails or restarts
networking errors causing 1+ members to get cut from the SHC
The current captain steps down after detecting a majority of members have stopped participating in the cluster
How is a Captain elected?
A majority vote of all the members
What protocol does captaincy voting use?
The RAFT protocol
