topic Re: How to enable clustering ? in Deployment Architecture

How to enable clustering ?

_Raj — Wed, 15 Oct 2025 11:17:41 GMT

Hi,

Please guide me how to enable clustering (splunk enable cluster-master, splunk edit cluster-config) for one instance as Cluster Master, 3 instances as Indexers, 3 instances as Search Heads.

Thanks

Re: How to enable clustering ?

gcusello — Wed, 15 Oct 2025 11:24:33 GMT

Hi @_Raj ,

see these:

https://www.youtube.com/watch?v=ZiNCRsUE7LQ

https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/10.0/overview-of-indexer-clusters-and-index-replication/about-indexer-clusters-and-index-replication

https://docs.splunk.com/Documentation/Splunk/9.3.1/Indexer/Clusterdeploymentoverview

https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.4/overview-of-search-head-clustering/about-search-head-clustering

https://www.youtube.com/watch?v=VPa3EjqD8Q4

https://www.youtube.com/watch?v=3JjLtoRDXOE

Ciao.

Giuseppe

Re: How to enable clustering ?

thahir — Wed, 15 Oct 2025 11:59:00 GMT

Hi @_Raj ,

you can refer the below steps to enable the clustering part

Pre-requisites

-> Ensure all Splunk instances have compatible versions.
-> Network connectivity and required firewall ports between all instances must be open.
-> Have a look on the License part as well

Configure Cluster Manager (Master Node)

1. On the instance to be Cluster Master, run these commands under $SPLUNKHOME path usually /opt/splunk/bin

splunk edit cluster-config -mode master -replication_factor <number> -search_factor <number> -secret <your_security_key> -cluster_label <your_cluster_name>

2. Restart the Splunk

Configure Indexer Cluster Members (3 Indexers)

1.Enable indexer clustering and set the master URI and secret:

splunk edit cluster-config -mode peer -master_uri <uri_of_cluster_master>:<management_port> -replication_port <replication_port> -secret <security_key>

2. Then Splunk restart and validate the Splunkd logs

ref: https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/9.4/configure-the-peers/configure-peer-nodes-with-the-cli#id_0df861c8_c6f3_4a89_850e_1a2d82f7bac8__Configure_peer_nodes_with_the_CLI

Configure Search Head Cluster (3 Search Heads)

-> On one Search Head, enable search head clustering and bootstrap the cluster, execute the below command on the Splunk bin path

splunk init shcluster-config -auth <username>:<password> -mgmt_uri <URI>:<management_port> -replication_port <replication_port> -replication_factor <n> -conf_deploy_fetch_url <URL>:<management_port> -secret <security_key> -shcluster_label <label>

repeat for the other two nodes

splunk restart

Run the splunk bootstrap shcluster-captain command on the selected instance:

splunk bootstrap shcluster-captain -servers_list "<URI>:<management_port>,<URI>:<management_port>,..." -auth <username>:<password>

Ref: https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.4/deploy-search-head-clustering/deploy-a-search-head-cluster#id_1d3fdf18_058b_4743_9eba_b33686542953__Deploy_a_search_head_cluster

Re: How to enable clustering ?

_Raj — Wed, 15 Oct 2025 15:03:43 GMT

@thahir

How to do this in UI mode is there option ?

Re: How to enable clustering ?

richgalloway — Wed, 15 Oct 2025 15:15:31 GMT

There is no GUI for setting up Splunk clusters. You must use the CLI.

Re: How to enable clustering ?

vjdev — Sun, 19 Oct 2025 19:06:08 GMT

Hello,

+++++++++++++
Indexer Cluster +
+++++++++++++

Via GUI
========

cluster-manager
--------------

Settings -> Indexer Clustering -> Enable indexer clustering -> Manager node ->

Replication Factor : 2
Search Factor : 2
Security Key :passkey123
Cluster Label : Cluster1

Click -> Enable Manger Node

Peer Node
----------

Settings -> Indexer Clustering -> Enable indexer clustering -> Peer node

Manager URI : https://managerip:8089 [Cluster manager]
Peer replication port : 8080
Security key : passkey123

Click -> Enable Peer Node

Search head node
----------------
Settings -> Indexer Clustering -> Enable indexer clustering -> Search head node

Manager URI : https://managerip:8089
Security key : passkey123

Click -> Enable Search head Node

Via Config File:
========

Manager:
--------

server.conf

[clustering]
mode = manager
replication_factor = 2
search_factor = 2
pass4SymmKey = passkey123
cluster_label = cluster1

Peer Node:
----------

server.conf

[replication_port://8080]

[clustering]
manager_uri = https://managerip:8089
mode = peer
pass4SymmKey = passkey123

Search Head:
------------

[clustering]
manager_uri = https://managerip:8089
mode = searchhead
pass4SymmKey = passkey123

Via Cli
=======

Manager Node:
--------------
./splunk edit cluster-config -mode manager -replication_factor 2 -search_factor 2 -secret passkey123 -cluster_label cluster1

./splunk restart

Peer Node:
----------

./splunk edit cluster-config -mode peer -manager_uri https://managerip:8089 -replication_port 8080 -secret passkey123

./splunk restart

Search Head:
------------

./splunk edit cluster-config -mode searchhead -manager_uri https://managerip:8089 -secret passkey123

./splunk restart

./splunk show cluster-status

+++++++++++++++++++++++++++++++++++++++++

++++++++++++++++++
Searh Head Cluster
++++++++++++++++++

Deployer
------------

server.conf

[shclustering]
pass4SymmKey = yoursecuritykey
shcluster_label = shcluster1

SH
---

/opt/splunk/bin/splunk init shcluster-config -auth admin:changed -mgmt_uri https://sh1.example.com:8089 -replication_port 8887 -replication_factor 2 -conf_deploy_fetch_url https://deployerip:8089 -secret yoursecuritykey -shcluster_label shcluster1

[Repeat On all SH only by changing mgmt_uri]

Once done in All SH. Choose captain.

/opt/splunk/bin/splunk bootstrap shcluster-captain -servers_list "https://sh1.example.com:8089,https://sh2.example.com:8089,https://sh3.example.com:8089,https://sh4.example.com:8089" -auth admin:changed

Check Status

/opt/splunk/bin/splunk show shcluster-status

Thank You!