https://community.splunk.com/t5/Splunk-Enterprise/Master-node-shows-up-as-Search-head/m-p/346217#M6566 <P>I have a second cluster defined:</P> <PRE><CODE>Splunk-msta (cluster master) | Splunka (Search head in the cluster) | | splunk-idxa &amp; splunk-idxc | splunk-fwda </CODE></PRE> <P>and only splunka shows up as search heads (not splunka and splunk-msta).</P> <P>Why do i not see same behavior with this cluster?</P> Wed, 02 Aug 2017 23:25:34 GMT dif2175509 2017-08-02T23:25:34Z https://community.splunk.com/t5/Splunk-Enterprise/Master-node-shows-up-as-Search-head/m-p/346215#M6564 <P>I have defined a cluster as follows:</P> <P>Splunk-mstb (cluster master)<BR /> |<BR /> Splunkb (Search head in the cluster)<BR /> |<BR /> splunk-idxb<BR /> |<BR /> splunk-fwdb</P> <P>and both my Splunkb and splunk-mstb show up as search heads.</P> <P>My server.conf only has the following in it:</P> <P>[clustering]<BR /> mode = master</P> <P>How can I remove the errant Search head entry (and from where)?</P> Wed, 02 Aug 2017 19:27:23 GMT https://community.splunk.com/t5/Splunk-Enterprise/Master-node-shows-up-as-Search-head/m-p/346215#M6564 dif2175509 2017-08-02T19:27:23Z https://community.splunk.com/t5/Splunk-Enterprise/Master-node-shows-up-as-Search-head/m-p/346216#M6565 <P>dif2175509,</P> <P>When you configure the indexer cluster, cluster master will show up as one of the search heads. This is default behavior.In this case you can use the master node for the troubleshooting purposes and not really for production searches.</P> Wed, 02 Aug 2017 22:15:58 GMT https://community.splunk.com/t5/Splunk-Enterprise/Master-node-shows-up-as-Search-head/m-p/346216#M6565 bheemireddi 2017-08-02T22:15:58Z https://community.splunk.com/t5/Splunk-Enterprise/Master-node-shows-up-as-Search-head/m-p/346217#M6566 <P>I have a second cluster defined:</P> <PRE><CODE>Splunk-msta (cluster master) | Splunka (Search head in the cluster) | | splunk-idxa &amp; splunk-idxc | splunk-fwda </CODE></PRE> <P>and only splunka shows up as search heads (not splunka and splunk-msta).</P> <P>Why do i not see same behavior with this cluster?</P> Wed, 02 Aug 2017 23:25:34 GMT https://community.splunk.com/t5/Splunk-Enterprise/Master-node-shows-up-as-Search-head/m-p/346217#M6566 dif2175509 2017-08-02T23:25:34Z https://community.splunk.com/t5/Splunk-Enterprise/Master-node-shows-up-as-Search-head/m-p/346218#M6567 <P>Are you sure of the configurations on this cluster where you don't see Cluster master as the search head?<BR /> Do you see the cluster enabled when you login to the Cluster Master GUI? is the master configured with correct mode? your hostnames overlap between first and second cluster.. hopefully you have the right names in the configurations</P> Thu, 03 Aug 2017 02:05:03 GMT https://community.splunk.com/t5/Splunk-Enterprise/Master-node-shows-up-as-Search-head/m-p/346218#M6567 bheemireddi 2017-08-03T02:05:03Z https://community.splunk.com/t5/Splunk-Enterprise/Master-node-shows-up-as-Search-head/m-p/346219#M6568 <P>There is no overlap between msta and mstb clusters. </P> <P>All the VM names are correct (as well as the names within the Splunk instance). I have built the clusters but not defined any indexes yet. </P> <P>The GUI in the cluster, msta, shows the correct indexer peers (idxa and idxc) and search head (splunka) </P> <P>The GUI in the cluster, mstb, shows the correct index peer (idxb) and two search heads (mstb and splunkb).</P> <P>If i was getting similar behavior in both clusters it would not cause concern.</P> Thu, 03 Aug 2017 09:52:21 GMT https://community.splunk.com/t5/Splunk-Enterprise/Master-node-shows-up-as-Search-head/m-p/346219#M6568 dif2175509 2017-08-03T09:52:21Z