https://community.splunk.com/t5/Deployment-Architecture/Is-there-way-to-prevent-a-certain-search-head-from-becoming-the/m-p/268415#M10246 <P>Giving it a go, will report back after a couple of cluster elections. Thanks for the idea!</P> Thu, 10 Dec 2015 11:23:38 GMT alekksi 2015-12-10T11:23:38Z https://community.splunk.com/t5/Deployment-Architecture/Is-there-way-to-prevent-a-certain-search-head-from-becoming-the/m-p/268413#M10244 <P>Hi all,</P> <P>I've got a search head cluster set up with three sites -- two relatively nearby, plus a search head in another location to act as a witness and provide the deciding vote if, for whatever reason, we lost one of our sites. </P> <P>The main issue is that this search head is on minimal kit and is far enough away that the search heads start complaining that everything takes too long / keeps timing out.<BR /> Is there a way to prevent this search head from becoming the captain?</P> <P>Best regards,<BR /> Alex</P> Wed, 09 Dec 2015 16:11:07 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-there-way-to-prevent-a-certain-search-head-from-becoming-the/m-p/268413#M10244 alekksi 2015-12-09T16:11:07Z https://community.splunk.com/t5/Deployment-Architecture/Is-there-way-to-prevent-a-certain-search-head-from-becoming-the/m-p/268414#M10245 <P>Please note that this is completely untested. I</P> <P>I do see a attribute under [shclustering] which defines the time a member will wait before tying to become captain. My guess would be that if set this to a high value, the member would never be able to become captain (as the timer from others will end before this and they will get elected).</P> <PRE><CODE>election_timeout_ms = &lt;positive_integer&gt; * The amount of time that a member will wait before trying to become the captain. * Half of this value is the heartbeat period. * A very low value of election_timeout_ms can lead to unnecessary captain elections. * The default is 60000ms, or 1 minute. </CODE></PRE> Wed, 09 Dec 2015 17:08:01 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-there-way-to-prevent-a-certain-search-head-from-becoming-the/m-p/268414#M10245 somesoni2 2015-12-09T17:08:01Z https://community.splunk.com/t5/Deployment-Architecture/Is-there-way-to-prevent-a-certain-search-head-from-becoming-the/m-p/268415#M10246 <P>Giving it a go, will report back after a couple of cluster elections. Thanks for the idea!</P> Thu, 10 Dec 2015 11:23:38 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-there-way-to-prevent-a-certain-search-head-from-becoming-the/m-p/268415#M10246 alekksi 2015-12-10T11:23:38Z https://community.splunk.com/t5/Deployment-Architecture/Is-there-way-to-prevent-a-certain-search-head-from-becoming-the/m-p/268416#M10247 <P>Try this if it's on 6.3 </P> <PRE><CODE><A href="http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/Transfercaptain" target="test_blank">http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/Transfercaptain</A> </CODE></PRE> Thu, 10 Dec 2015 12:29:17 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-there-way-to-prevent-a-certain-search-head-from-becoming-the/m-p/268416#M10247 renjith_nair 2015-12-10T12:29:17Z https://community.splunk.com/t5/Deployment-Architecture/Is-there-way-to-prevent-a-certain-search-head-from-becoming-the/m-p/268417#M10248 <P>Unfortunately not -- hopefully should be soon, though. Thanks for the URL.</P> Thu, 10 Dec 2015 12:34:07 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-there-way-to-prevent-a-certain-search-head-from-becoming-the/m-p/268417#M10248 alekksi 2015-12-10T12:34:07Z