topic Re: Search Head Clustering Question in Deployment Architecture

Search Head Clustering Question

jspvkey — Tue, 12 May 2015 14:19:22 GMT

Hi,
I currently have a standalone Search Head and I will soon be deploying a search Head Cluster using 3 different machines. Before deploying the Cluster, Do I need to first remove the Standalone Search Head? I am planning to use the Standalone Search Head as the Deployer to push the configs to Cluster Members. Also, can I move the user accounts from Current search Head into to the cluster?

Thanks,
Joseph

Re: Search Head Clustering Question

Raghav2384 — Tue, 12 May 2015 18:35:45 GMT

Hi,

Here's the process for setting up a SHC.

First: Pick a deployer and this should be the first box to setup
Second: Initialize SHC member by telling them who the boss is (Deployer)
Third: Elect a captain

you can export all the views,searches etc from different app contexts from your existing search to be on safe side.

http://docs.splunk.com/Documentation/Splunk/6.2.3/DistSearch/PropagateSHCconfigurationchanges

Hope this helps!
Thanks,
Raghav

Re: Search Head Clustering Question

jspvkey — Tue, 12 May 2015 19:35:48 GMT

Thanks for your response.SO, Can both a Standalone Search Head and a Search Head Cluster co-exist in the same environment?

Thanks

Re: Search Head Clustering Question

krish3 — Tue, 12 May 2015 19:41:10 GMT

Yes standalone and SH cluster can co exist. But the knowledge objects,users and roles will be limited to SHC or standalone depending where they exist. You cannot use the knowledge objects created on Standalone in SHC and vice versa.

Re: Search Head Clustering Question

Raghav2384 — Tue, 12 May 2015 19:42:17 GMT

Didn't understand your question. Are you talking about having two separate instances?If yes, you can have 100s of instances as long as the SHC member is not part of another distributed search (Which is not possible by the way)

Re: Search Head Clustering Question

jspvkey — Tue, 12 May 2015 19:51:02 GMT

I was thinking about having a standalone search head and a cluster at the same time. I am planning to migrate to Search Head Cluster and I want to maintain a Backup Search Head (standalone) until I verify that the cluster is working fine.

Re: Search Head Clustering Question

Raghav2384 — Tue, 12 May 2015 19:55:48 GMT

Absolutely! That is quite possible

Re: Search Head Clustering Question

jspvkey — Tue, 12 May 2015 19:56:53 GMT

Thankyou..

Re: Search Head Clustering Question

jspvkey — Tue, 12 May 2015 19:57:14 GMT

Thanks.....

Re: Search Head Clustering Question

guotao4321 — Fri, 21 Oct 2016 02:31:59 GMT

I have a question here. If all the search heads are same, do we still need to setup deployer before initializing SHC member?

Re: Search Head Clustering Question

esix_splunk — Fri, 21 Oct 2016 03:47:50 GMT

Yes. Deployer has to be defined in the configurations.

Re: Search Head Clustering Question

guotao4321 — Tue, 29 Sep 2020 11:28:30 GMT

Thanks for your reply.

However, I check the document: http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/SHCdeploymentoverview

It says:
"It is recommended that you select the deployer now, as part of cluster set-up, because you need a deployer in place before you can distribute apps and updated configurations to the cluster members."
Does it mean that if we dont need to distribute apps and update configuration, there is no need to setup the deployer?

Another one:
"The -conf_deploy_fetch_url parameter specifies the URL and management port for the deployer instance. This parameter is optional during initialization, but you do need to set it before you can use the deployer functionality. See "Use the deployer to distribute apps and configuration updates." "

I just setup a SH cluster with 3 nodes and without deployer, but when I run the command "show shcluster-status", the member list just shows the captian, no other member. This is same when running the command on each search head.

[root@deploy-searchhead01 ~]# /opt/splunk/bin/splunk bootstrap shcluster-captain -servers_list "https://deploy-searchhead01.bigdata.emc.local:8089,https://deploy-searchhead02.bigdata.emc.local:8089,https://deploy-searchhead03.bigdata.emc.local:8089" -auth admin:changeme
Successfully bootstrapped this node as the captain with the given servers.
[root@deploy-searchhead01 ~]# /opt/splunk/bin/splunk show shcluster-status -auth admin:changeme

Captain:
dynamic_captain : 1
elected_captain : Fri Oct 21 12:20:43 2016
id : 6F21DCB3-0E06-4AA0-8E1C-7FE2D2712588
initialized_flag : 0
label : deploy-searchhead01.bigdata.emc.local
mgmt_uri : https://deploy-searchhead01.bigdata.emc.local:8089
min_peers_joined_flag : 0
rolling_restart_flag : 0
service_ready_flag : 0

Members:
deploy-searchhead01.bigdata.emc.local
label : deploy-searchhead01.bigdata.emc.local
mgmt_uri : https://deploy-searchhead01.bigdata.emc.local:8089
mgmt_uri_alias : https://172.16.1.72:8089

status : Up

Thank you very much if you can help on it.

Re: Search Head Clustering Question

guotao4321 — Fri, 21 Oct 2016 06:38:07 GMT

issue fixed. Check the log for reason: splunk/var/log/splunk/splunkd.log

Re: Search Head Clustering Question

jmargolies — Mon, 07 Nov 2016 19:52:51 GMT

I have a certain doubt.

"you can export all the views,searches etc from different app contexts from your existing search to be on safe side"

If I setup search head clustering later on. How do the dashboards, artifacts etc. Propagate from one site to the other? Should I back them up first ? Is this what you mean by exporting them to be safe?

Re: Search Head Clustering Question

jmargolies — Mon, 07 Nov 2016 19:53:21 GMT

I have a certain doubt.

"you can export all the views,searches etc from different app contexts from your existing search to be on safe side"

Re: Search Head Clustering Question

jmargolies — Mon, 07 Nov 2016 19:55:19 GMT

sorry I posted this twice somehow it didn't update