topic Re: Splunk CLI command to list all Search Heads from Cluster Master in Splunk Enterprise

Splunk CLI command to list all Search Heads from Cluster Master

amyboxy — Wed, 29 Sep 2021 07:49:30 GMT

I have setup an Indexer Cluster and joined Search Heads and Peer nodes to the Cluster Master.

I am able to see all the Peers, Indexes, Search Heads from Cluster Master Web Interface (Settings -> Indexer Clustering).

But I am looking for a CLI command that will list all the Search Heads that have joined this Cluster Master.

I have tried these but none of these show Search Head Nodes information.
$ splunk list cluster-generation
$ splunk list cluster-config
$ splunk show cluster-status

Re: Splunk CLI command to list all Search Heads from Cluster Master

richgalloway — Wed, 29 Sep 2021 12:29:11 GMT

I don't have a CM with which to test this, but one of the REST API commands may give you the information you seek.

curl -k -u admin:password https://<host>:<mPort>/services/cluster/manager/info

See https://docs.splunk.com/Documentation/Splunk/8.2.2/RESTREF/RESTcluster#cluster.2Fmanager.2Finfo for details.

Re: Splunk CLI command to list all Search Heads from Cluster Master

amyboxy — Wed, 29 Sep 2021 13:00:04 GMT

Thanks for the reply but this still not giving me information on Search Heads Nodes... It is actually the XML form of CLI commands.

Re: Splunk CLI command to list all Search Heads from Cluster Master

somesoni2 — Wed, 29 Sep 2021 13:33:54 GMT

You can use following endpoint to get list of search head in the indexer cluster:

https://docs.splunk.com/Documentation/Splunk/8.2.2/RESTREF/RESTcluster#cluster.2Fsearchhead.2Fgeneration

You can view other endpoint starting with "cluster/searchhead" as they give different details about the cluster's search head.

Re: Splunk CLI command to list all Search Heads from Cluster Master

amyboxy — Wed, 29 Sep 2021 13:49:59 GMT

Yes, I tried this REST API call from CM and it would not return anything related to Search Head Nodes.

I can get the Search Head nodes information from Search Head nodes(captain) but still not able to get these SH nodes from Cluster Master that owns Indexer Cluster.

Re: Splunk CLI command to list all Search Heads from Cluster Master

HadrianusHon — Fri, 22 Apr 2022 03:18:41 GMT

try ./splunk show shcluster-status --verbose

Re: Splunk CLI command to list all Search Heads from Cluster Master

PickleRick — Fri, 22 Apr 2022 05:19:14 GMT

Well, the indexer cluster doesn't know much about the search head cluster. If you're executing shcluster management commanda from a shcluster member, it knows that it's a shcluster member and knows where to look for captain and other info from there.

If you're calling the commands from other nodes (including CM), the splunk configuration on that node is not aware of any shclustering because it's not a part of shcluster. So you have to use the -uri option to call the proper splunk instance (a shcluster member).

Re: Splunk CLI command to list all Search Heads from Cluster Master

isoutamo — Fri, 22 Apr 2022 14:05:07 GMT

I'm not sure it you count this as a CLI, but you can try this

splunk search '(host=<your idx nodes on cluster> ((index=_internal sourcetype=splunkd_remote_searches "Streamed search search starting"))) | table server| dedup server'

Of course this needs that those SHs have made queries to this cluster.

r. Ismo