topic Re: When will Search Head Clustering be enabled for Windows? in Getting Data In

When will Search Head Clustering be enabled for Windows?

MartinMcNutt — Thu, 30 Oct 2014 19:57:55 GMT

I was really looking forward to getting rid of search head pooling. Been a thorn in my side since implementing splunk.

Is it coming in a 6.2. dot release or 6.3?

Re: When will Search Head Clustering be enabled for Windows?

gkanapathy — Thu, 30 Oct 2014 21:22:01 GMT

It will not available in a 6.2.x maintenance release. It would have to wait until a future minor (or major) release. (Note that the version number of the next non-maintenance release of Splunk has not yet been determined.)

Re: When will Search Head Clustering be enabled for Windows?

jkat54 — Sat, 01 Nov 2014 02:26:35 GMT

I just setup search head clustering in AWS with windows server 2008 r2.

I havent setup a deployer yet, but searches are working and the shcluster status command looks good. I even did it with just 2 search heads instead of 3. (replication factor 2).

I used this binary: splunk-6.2.0-237341-x64-release.msi

Re: When will Search Head Clustering be enabled for Windows?

jkat54 — Sat, 01 Nov 2014 02:27:58 GMT

PS C:\Program Files\Splunk\bin> .\splunk.exe show shcluster-status -auth admin:admin

 Captain:
                          elected_captain : Fri Oct 31 17:19:06 2014
                                       id : CF508875-4F9F-48BB-8CED-0766FA046729
                         initialized_flag : 1
                                    label : WIN-DB5M3IDFOBE
                         maintenance_mode : 0
                                 mgmt_uri : https://172.31.16.105:8089
                    min_peers_joined_flag : 1
                     rolling_restart_flag : 0
                       service_ready_flag : 1

 Members:
        WIN-DB5M3IDFOBE
                                    label : WIN-DB5M3IDFOBE
                                 mgmt_uri : https://172.31.16.105:8089
                                   status : Up
        WIN-9FRI2MKI5GV
                                    label : WIN-9FRI2MKI5GV
                                 mgmt_uri : https://172.31.23.67:8089
                                   status : Up

Re: When will Search Head Clustering be enabled for Windows?

MartinMcNutt — Sat, 01 Nov 2014 02:37:52 GMT

You got me really confused now..

READTHISFIRST says near the bottom "No support for search head clustering in Windows

Re: When will Search Head Clustering be enabled for Windows?

jkat54 — Sat, 01 Nov 2014 04:30:17 GMT

http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCsystemrequirements

The above document says

Splunk does not currently support search head clustering on Windows systems.

It also says:

You must deploy at least as many members as either the replication factor or three, whichever is greater.

But I have a replication factor of 2, and only 2 search heads. 3 is greater than 2 and is therefore the minimum according to the document. However, I'm up and running on a 2 search head, search head cluster right now in Windows 2008 R2 SP1 and it works flawlessly.

I cant get the photo upload to work right now but I'm serious. Works fine.

Re: When will Search Head Clustering be enabled for Windows?

mahamed_splunk — Sat, 01 Nov 2014 04:44:08 GMT

The document correctly states that SHC is not 'supported' on windows, which means that if you run SHC on windows and run into a bug and call support for help, they would refuse to take a look because it is not officially supported. That's the risk of running any unsupported version in production.

As you rightly demonstrated, it is possible to setup a small cluster on Windows. However, SHC haven't gone through our extensive testing on Windows during 6.2 time frame, hence we are not supporting it in 6.2 and the support will be added in the next version of Splunk.

Re: When will Search Head Clustering be enabled for Windows?

MartinMcNutt — Sat, 01 Nov 2014 05:16:49 GMT

Translation:

Windows is low on our priority list and it might make it into next years .conf release.

If I knew how splunk would treat the windows platform...I would not have picked windows as the OS for my 40+ systems. Unfortunately due to the evil custom security layer on unix, windows was the lesser evil of the two.

Re: When will Search Head Clustering be enabled for Windows?

jkat54 — Sat, 01 Nov 2014 05:36:36 GMT

Thanks for the follow up Mahamed. That's what I assumed the issue was.

Here's a thought though, why did we deprecate search head pooling while not supporting search head clustering for windows? That effectively means we dont want users of the 6.2 windows version using clusters or pools.

This is why I interpreted it as support coming very soon, probably works fine already. So I have about 3 months before I put this thing in production. Can you guess if the supported release will be available in less than 3 months?

Re: When will Search Head Clustering be enabled for Windows?

mahamed_splunk — Sat, 01 Nov 2014 15:10:06 GMT

Deprecation means the feature is still in the product but will be removed in the later releases. So if you must run on windows, your best bet would be to use SHP on windows in 6.2 and migrate to SHC later.

Can you guess if the supported release will be available in less than 3 months?

My guess is that it would take longer than 3 months

Windows is low on our priority list and it might make it into next years .conf release.

Not really. We had 2 options. Either delay releasing SHC altogether until all platforms are available OR release SHC on Linux now and add windows support in the next release. We went with second option. Not ideal, but at least Linux users are able to take advantage of the SHC features now.

Re: When will Search Head Clustering be enabled for Windows?

jkat54 — Sun, 02 Nov 2014 00:33:09 GMT

Thank you so much Mahamed! Cheers!

Re: When will Search Head Clustering be enabled for Windows?

jkat54 — Sun, 02 Nov 2014 00:36:19 GMT

Thank you very much Mahamed.

Linux FTW!

Cheers!

Re: When will Search Head Clustering be enabled for Windows?

MartinMcNutt — Sun, 02 Nov 2014 03:49:13 GMT

I dont have anything against Linux...The problem is there are more support silos I have to deal with. I can count about 3-4 teams that have their portion of linux support at my company. OS/Security/E-trust/Etc

Windows...i can bypass all them and support the servers all by myself.

Re: When will Search Head Clustering be enabled for Windows?

halr9000 — Mon, 17 Nov 2014 17:41:13 GMT

Deprecation is a frequent point of confusion. If something is deprecated, it's still supported, and the feature in question is still going to be around for (at least) 2 more major versions. That could easily be a couple of years, or longer. Deprecation is a great planning tool.

Re: When will Search Head Clustering be enabled for Windows?

rsathish47 — Wed, 23 Sep 2015 05:20:55 GMT

Search head clustering is available on all operating systems supported for Splunk Enterprise

Check the link

http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/SHCsystemrequirements,Check the link

Re: When will Search Head Clustering be enabled for Windows?

mahamed_splunk — Fri, 25 Sep 2015 11:01:01 GMT

That's correct. SHC is supported on Windows starting with 6.3