Archive
Highlighted

Master node shows up as Search head

New Member

I have defined a cluster as follows:

Splunk-mstb (cluster master)
|
Splunkb (Search head in the cluster)
|
splunk-idxb
|
splunk-fwdb

and both my Splunkb and splunk-mstb show up as search heads.

My server.conf only has the following in it:

[clustering]
mode = master

How can I remove the errant Search head entry (and from where)?

Tags (1)
0 Karma
Highlighted

Re: Master node shows up as Search head

Communicator

dif2175509,

When you configure the indexer cluster, cluster master will show up as one of the search heads. This is default behavior.In this case you can use the master node for the troubleshooting purposes and not really for production searches.

0 Karma
Highlighted

Re: Master node shows up as Search head

New Member

I have a second cluster defined:

Splunk-msta (cluster master)
|
Splunka (Search head in the cluster)
|                  |
splunk-idxa  & splunk-idxc
|
splunk-fwda

and only splunka shows up as search heads (not splunka and splunk-msta).

Why do i not see same behavior with this cluster?

0 Karma
Highlighted

Re: Master node shows up as Search head

Communicator

Are you sure of the configurations on this cluster where you don't see Cluster master as the search head?
Do you see the cluster enabled when you login to the Cluster Master GUI? is the master configured with correct mode? your hostnames overlap between first and second cluster.. hopefully you have the right names in the configurations

0 Karma
Highlighted

Re: Master node shows up as Search head

New Member

There is no overlap between msta and mstb clusters.

All the VM names are correct (as well as the names within the Splunk instance). I have built the clusters but not defined any indexes yet.

The GUI in the cluster, msta, shows the correct indexer peers (idxa and idxc) and search head (splunka)

The GUI in the cluster, mstb, shows the correct index peer (idxb) and two search heads (mstb and splunkb).

If i was getting similar behavior in both clusters it would not cause concern.

0 Karma