topic Re: Why is there no "cluster master" in Splunk recommendations? in Deployment Architecture

Why is there no "cluster master" in Splunk recommendations?

psaminadin — Thu, 11 Jun 2020 00:35:03 GMT

Hi,

We are sizing a Splunk infrastructure and I was looking at this page :

Summary of performance recommendations

https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/Summaryofperformancerecommendations

https://docs.splunk.com/Documentation/Splunk/latest/Capacity/Summaryofperformancerecommendations

On this page, there is an example of Splunk cluster with
- 1 SH
- 2 indexers

But in the "cluster administration course, it is explicitly said:
- the master nod must be run a dedicated node
- the master cannot be shared with the search head node
So the minimum cluster should be :
- 1 SH
- 2 indexers
- 1 Master

Can someone explain this to me?
- Why there is no master node on the recommendation page?
-If it's possible to share the search head and cluster master in production

Best regards

Pierre

Re: Why is there no "cluster master" in Splunk recommendations?

gcusello — Mon, 14 Oct 2019 15:46:52 GMT

Hi psaminadin,
Cluster Master and Master Node are the same thing!
When you speak of "recommendation page" are you speaking of Hardware reference o what else?
If you're speaking of Hardware reference, there isn't any reference for CM, but if you run an Health Check from the Monitoring Console, youll' have a warning for the configuration, that should be at least 12 CPUs and 12 GB of RAM.

Cluster Master MUST have a dedicated server, can eventually be shared with low impact instances as Deployer or License Master, but NEVER with Deployment Server, Indexer or Search Head.

As you can see at https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Systemrequirements , there are some main issues to note:

Each cluster node (master, peer, or search head) must reside on a separate Splunk Enterprise instance;
Each node instance must run on a separate machine or virtual machine, and each machine must be running the same operating system;
All nodes must be connected over a network;
There are strict version compatibility requirements between cluster nodes (they must have the same Splunk version).

Ciao.
Giuseppe

Re: Why is there no "cluster master" in Splunk recommendations?

Steve_G_ — Mon, 14 Oct 2019 16:00:54 GMT

The topic in the Capacity Planning Manual just covers the relative requirements for search heads and indexers, based on your capacity needs.

If you set up an indexer cluster, there are a large number of other issues that you need to accommodate, including the cluster node requirements. Those are not specifically related to capacity concerns, and thus are not covered in the Capacity Planning Manual.

Rather, look in the Managing Indexers and Clusters of Indexers manual, where indexer clusters are covered in detail. Specifically, read the systems requirements topic: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Systemrequirements

Re: Why is there no "cluster master" in Splunk recommendations?

bastug58 — Wed, 22 Apr 2020 12:30:32 GMT

So what about Cluster Master's disk requirements? Let say there are two indexers need to be managed by cluster masters?